Edit tour

Windows Analysis Report
TsU2RShnl7.exe

Overview

General Information

Sample name:	TsU2RShnl7.exe renamed because original name is a hash value
Original sample name:	443b3b9929156d71ed73e99850a671a89d4d0d38cc8acc7f286696dd4f24895e.exe
Analysis ID:	1407361
MD5:	5fd249a523f8006dae95752b5cf9bf49
SHA1:	e6e02da45574070c899c51f2400f9bd3171b02f0
SHA256:	443b3b9929156d71ed73e99850a671a89d4d0d38cc8acc7f286696dd4f24895e
Tags:	exe
Infos:

Detection

PureLog Stealer

Score:	42
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	33
Range:	0 - 100

Signatures

Yara detected PureLog Stealer

.NET source code contains method to dynamically call methods (often used by packers)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Uses the system / local time for branch decision (may execute only at specific dates)

Classification

Process Tree

System is w10x64

TsU2RShnl7.exe (PID: 5004 cmdline: C:\Users\user\Desktop\TsU2RShnl7.exe MD5: 5FD249A523F8006DAE95752B5CF9BF49)

setup.exe (PID: 7204 cmdline: C:\Users\user\AppData\Local\Temp\adguard\setup.exe "AID=31220" MD5: 0F6253C9F6113590AC12E665670E5870)

setup.exe (PID: 7228 cmdline: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=708 -burn.filehandle.self=744 "AID=31220 MD5: BCAB2557997868A7B0E6DFE214A48969)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.Base.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.UI.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.CrashReporter.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.dll	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.dll	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.4135043337.0000000006632000.00000002.00000001.01000000.00000011.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000002.00000002.4137906412.0000000006E82000.00000002.00000001.01000000.00000013.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000002.00000002.4138160484.0000000006F22000.00000002.00000001.01000000.00000014.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000002.00000002.4136698136.0000000006B52000.00000002.00000001.01000000.00000012.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Unpacked PEs

Source	Rule	Description	Author
2.2.setup.exe.6e80000.7.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
2.2.setup.exe.6f20000.8.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
2.2.setup.exe.6630000.4.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
2.2.setup.exe.6b50000.5.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
2.2.setup.exe.6b50000.5.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Cryptography

Uses Microsoft's Enhanced Cryptographic Provider

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00BE9F8F DecryptFileW,	1_2_00BE9F8F
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00C0F340 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	1_2_00C0F340
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00BE9D74 DecryptFileW,DecryptFileW,	1_2_00BE9D74
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_001F9F8F DecryptFileW,	2_2_001F9F8F
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_0021F340 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,	2_2_0021F340
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_001F9D74 DecryptFileW,DecryptFileW,	2_2_001F9D74

Compliance

Uses 32bit PE files

Source: TsU2RShnl7.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 156.146.36.23:443 -> 192.168.2.4:49734 version: TLS 1.0

PE / OLE file has a valid certificate

Source: TsU2RShnl7.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 156.146.36.23:443 -> 192.168.2.4:49732 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: TsU2RShnl7.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: AdGuard.Utils.Base.pdb source: setup.exe, setup.exe, 00000002.00000002.4135043337.0000000006632000.00000002.00000001.01000000.00000011.sdmp, setup.exe, 00000002.00000002.4148412119.000000000E4BC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: ndows\dll\System.pdb source: setup.exe, 00000002.00000002.4129180636.0000000000B18000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: //.pdb source: setup.exe, 00000002.00000002.4148412119.000000000E4BC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mDC:\Windows\AdGuard.Utils.Base.pdb source: setup.exe, 00000002.00000002.4148412119.000000000E4BC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: AdGuard.Utils.Base.pdb3693405117-2476756634-1002_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver3215ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f747 source: setup.exe, 00000002.00000002.4144647270.000000000D0D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Bamboo\bamboo-agent-home\xml-data\build-dir\WIN-BVR4-JOB1\AdGuardVpn\Installer\AdGuardVpn.Burn\obj\Release\AdGuardVpn.Burn.pdb\ source: setup.exe, 00000002.00000002.4134466876.00000000063EA000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\Users\Bamboo\bamboo-agent-home\xml-data\build-dir\WIN-BVR4-JOB1\AdGuardVpn\Installer\AdGuardVpn.Burn\obj\Release\AdGuardVpn.Burn.pdb source: setup.exe, setup.exe, 00000002.00000002.4134466876.00000000063EA000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: AdGuard.Utils.pdb source: setup.exe, setup.exe, 00000002.00000002.4136698136.0000000006B52000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: \??\C:\Windows\dll\AdGuard.Utils.Base.pdb` source: setup.exe, 00000002.00000003.3971391682.000000000D0EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: AdGuard.CrashReporter.pdbxE source: setup.exe, 00000002.00000002.4138160484.0000000006F22000.00000002.00000001.01000000.00000014.sdmp, AdGuard.CrashReporter.dll.2.dr
Source:	Binary string: symbols\dll\AdGuard.Utils.Base.pdb source: setup.exe, 00000002.00000002.4148412119.000000000E4BC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: AdGuard.CrashReporter.pdb source: setup.exe, setup.exe, 00000002.00000002.4138160484.0000000006F22000.00000002.00000001.01000000.00000014.sdmp, AdGuard.CrashReporter.dll.2.dr
Source:	Binary string: C:\raven\build\obj\Release\net45\SharpRaven.pdb source: setup.exe, setup.exe, 00000002.00000002.4137257641.0000000006DB2000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: AdGuard.Utils.UI.pdb source: setup.exe, setup.exe, 00000002.00000002.4137906412.0000000006E82000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\net45\Newtonsoft.Json.pdb source: setup.exe, setup.exe, 00000002.00000002.4140662194.0000000007692000.00000002.00000001.01000000.00000016.sdmp, Newtonsoft.Json.dll.2.dr
Source:	Binary string: mC:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.Base.pdb source: setup.exe, 00000002.00000002.4148412119.000000000E4BC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: AdGuard.Utils.Base.pdbs.Base.pdbpdbase.pdbFD8B648}\.ba\AdGuard.Utils.Base.pdb source: setup.exe, 00000002.00000002.4148412119.000000000E4BC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\mbahost.pdb source: setup.exe, 00000002.00000002.4148565608.000000006D014000.00000002.00000001.01000000.0000000C.sdmp, mbahost.dll.2.dr
Source:	Binary string: C:\Users\Bamboo\bamboo-agent-home\xml-data\build-dir\WIN-BWU-JOB1\AdGuard.Commons\build\obj\Release\AdGuard.Utils.Installer\AdGuard.Utils.Installer.pdb source: setup.exe, setup.exe, 00000002.00000002.4134315843.0000000006382000.00000002.00000001.01000000.00000010.sdmp, AdGuard.Utils.Installer.dll.2.dr
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\burn.pdb source: setup.exe, 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000001.00000000.1681263492.0000000000C1A000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000000.1685299582.000000000022A000.00000002.00000001.01000000.0000000B.sdmp, setup.exe, 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmp, setup.exe.0.dr
Source:	Binary string: m.pdb source: setup.exe, 00000002.00000002.4148412119.000000000E4BC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\agent\_work\66\s\build\obj\ship\x86\core\BootstrapperCore.pdb source: setup.exe, setup.exe, 00000002.00000002.4133924301.0000000005F82000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.2.dr
Source:	Binary string: C:\raven\build\obj\Release\net45\SharpRaven.pdbSHA256 source: setup.exe, 00000002.00000002.4137257641.0000000006DB2000.00000002.00000001.01000000.00000015.sdmp

Spreading

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00BE9A1D FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	1_2_00BE9A1D
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00C13C72 FindFirstFileW,FindClose,	1_2_00C13C72
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00BD3D4E GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	1_2_00BD3D4E
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_001F9A1D FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	2_2_001F9A1D
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_00223C72 FindFirstFileW,FindClose,	2_2_00223C72

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 2.2.setup.exe.6b50000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.dll, type: DROPPED

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: GET /installer.v1.0.json HTTP/1.1Host: static.adguard.comConnection: Keep-Alive

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 156.146.36.23 156.146.36.23

JA3 SSL client fingerprint seen in connection with other malware

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Uses insecure TLS / SSL version for HTTPS connection

Source: unknown

HTTPS traffic detected: 156.146.36.23:443 -> 192.168.2.4:49734 version: TLS 1.0

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\TsU2RShnl7.exe

Code function: 0_2_00EF8E34 GetLastError,InternetOpenW,InternetOpenUrlW,HttpQueryInfoA,InternetReadFile,WriteFile,RtlFreeHeap,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,GetLastError,FindCloseChangeNotification,

0_2_00EF8E34

Source: global traffic	HTTP traffic detected: GET /windows/installer.exe HTTP/1.1User-Agent: AdGuard VPN Web InstallerHost: static.adguardvpn.com
Source: global traffic	HTTP traffic detected: GET /installer.v1.0.json HTTP/1.1Host: static.adguard.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: static.adguardvpn.com

Source: setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://api.adguard.com/FDefault
Source: setup.exe, 00000002.00000002.4134466876.00000000063C2000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://api.adguard.com/uninstall.html
Source: setup.exe	String found in binary or memory: http://appsyndication.org/2006/appsyn
Source: setup.exe, 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000001.00000000.1681263492.0000000000C1A000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000000.1685299582.000000000022A000.00000002.00000001.01000000.0000000B.sdmp, setup.exe, 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmp, setup.exe.0.dr	String found in binary or memory: http://appsyndication.org/2006/appsynapplicationc:
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/NETFoundationProjectsCodeSigningCA.crt0
Source: TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: TsU2RShnl7.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=
Source: TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/NETFoundationProjectsCodeSigningCA.crl0E
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr	String found in binary or memory: http://crl4.digicert.com/NETFoundationProjectsCodeSigningCA.crl0L
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: Newtonsoft.Json.dll.2.dr	String found in binary or memory: http://james.newtonking.com/projects/json
Source: TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	String found in binary or memory: http://ocsp.comodoca.com0
Source: TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: TsU2RShnl7.exe, BootstrapperCore.dll.2.dr, mbahost.dll.2.dr, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0K
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	String found in binary or memory: http://ocsp.sectigo.com0
Source: setup.exe, setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000002.00000002.4134466876.00000000063EA000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://schemas.openxps.org/oxps/v1.0
Source: setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000002.00000002.4134466876.00000000063EA000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://schemas.openxps.org/oxps/v1.0$
Source: setup.exe, 00000002.00000002.4132352595.0000000003DED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: setup.exe, setup.exe, 00000002.00000002.4137257641.0000000006DB2000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: http://sentry-dsn.invalid
Source: setup.exe, setup.exe, 00000002.00000002.4132352595.0000000003DED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static.adguard.com/installer.v1.0.json
Source: setup.exe, 00000002.00000002.4134315843.0000000006382000.00000002.00000001.01000000.00000010.sdmp, AdGuard.Utils.Installer.dll.2.dr	String found in binary or memory: http://static.adguard.com/installer.v1.0.json=args
Source: setup.exe, 00000001.00000002.4129843205.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1693700250.0000000000AB5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.4131311874.0000000002D80000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exe
Source: setup.exe, 00000001.00000002.4128532484.000000000097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exe0
Source: setup.exe, 00000002.00000003.1693877181.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1693700250.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.4129180636.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exe4q
Source: TsU2RShnl7.exe	String found in binary or memory: http://static.adguardvpn.com/windows/installer.exe
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr	String found in binary or memory: http://wixtoolset.org
Source: setup.exe	String found in binary or memory: http://wixtoolset.org/
Source: setup.exe, 00000002.00000002.4133924301.0000000005F82000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.2.dr	String found in binary or memory: http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v
Source: setup.exe, setup.exe, 00000002.00000002.4133924301.0000000005F82000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.2.dr	String found in binary or memory: http://wixtoolset.org/news/
Source: setup.exe	String found in binary or memory: http://wixtoolset.org/releases/
Source: setup.exe, 00000002.00000002.4133924301.0000000005F82000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.2.dr	String found in binary or memory: http://wixtoolset.org/releases/SCreating
Source: setup.exe, 00000002.00000003.1693700250.0000000000AB5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010
Source: setup.exe	String found in binary or memory: http://wixtoolset.org/telemetry/v
Source: Newtonsoft.Json.dll.2.dr	String found in binary or memory: http://www.newtonsoft.com/jsonschema
Source: setup.exe, 00000001.00000003.1682984758.00000000009CD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000001.00000003.1682872535.00000000009CD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000001.00000002.4128532484.00000000009CD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000001.00000002.4129843205.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000002.00000002.4131311874.0000000002D80000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1693877181.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1693700250.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000002.00000002.4129180636.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://adguard.com
Source: setup.exe, 00000002.00000002.4135043337.0000000006632000.00000002.00000001.01000000.00000011.sdmp	String found in binary or memory: https://dev.adguard.com&https://adguard.com
Source: setup.exe, 00000002.00000002.4134466876.00000000063C2000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://devvpn.adguard.com/.https://adguard-vpn.com.https://link.adtidy.net
Source: setup.exe, 00000002.00000002.4132352595.0000000003E79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://error.c.cdn77.org/
Source: setup.exe, 00000001.00000002.4129843205.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000002.00000002.4131311874.0000000002D80000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000002.00000002.4129180636.0000000000A80000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kb.adguard.com/
Source: setup.exe, 00000001.00000002.4128532484.000000000097A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kb.adguard.com/)
Source: setup.exe, setup.exe, 00000002.00000002.4134466876.00000000063C2000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://link.adtidy.net
Source: setup.exe, 00000002.00000002.4132352595.0000000003DED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s10.adtidy.net:443/api/55/store/
Source: setup.exe, 00000002.00000002.4132352595.0000000003DED000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://s10.adtidy.net:443/api/embed/error-page/
Source: TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	String found in binary or memory: https://sectigo.com/CPS0
Source: setup.exe, 00000002.00000002.4132352595.0000000003E79000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://static.adguard.com
Source: TsU2RShnl7.exe, 00000000.00000003.1671048827.0000000001112000.00000004.00000020.00020000.00000000.sdmp, TsU2RShnl7.exe, 00000000.00000002.1683171456.0000000001123000.00000004.00000020.00020000.00000000.sdmp, TsU2RShnl7.exe, 00000000.00000003.1682085182.0000000001122000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.adguardvpn.com/
Source: TsU2RShnl7.exe	String found in binary or memory: https://static.adguardvpn.com/windows/installer.exe
Source: TsU2RShnl7.exe, 00000000.00000002.1682990739.00000000010D4000.00000004.00000020.00020000.00000000.sdmp, TsU2RShnl7.exe, 00000000.00000003.1682262101.00000000010D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.adguardvpn.com/windows/installer.exe6
Source: TsU2RShnl7.exe, 00000000.00000003.1682085182.0000000001112000.00000004.00000020.00020000.00000000.sdmp, TsU2RShnl7.exe, 00000000.00000002.1683108457.0000000001112000.00000004.00000020.00020000.00000000.sdmp, TsU2RShnl7.exe, 00000000.00000003.1671048827.0000000001112000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.adguardvpn.com/windows/installer.exeK
Source: TsU2RShnl7.exe, 00000000.00000002.1682990739.000000000109E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.adguardvpn.com/windows/installer.exeZ
Source: TsU2RShnl7.exe, 00000000.00000002.1682990739.00000000010D4000.00000004.00000020.00020000.00000000.sdmp, TsU2RShnl7.exe, 00000000.00000003.1682262101.00000000010D4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://static.adguardvpn.com/windows/installer.exen
Source: BootstrapperCore.dll.2.dr, mbahost.dll.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: setup.exe, setup.exe, 00000002.00000002.4137257641.0000000006DB2000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://www.getsentry.com
Source: setup.exe, 00000002.00000002.4137257641.0000000006DB2000.00000002.00000001.01000000.00000015.sdmp	String found in binary or memory: https://www.getsentry.com.
Source: Newtonsoft.Json.dll.2.dr	String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734

Uses secure TLS version for HTTPS connections

Source: unknown

HTTPS traffic detected: 156.146.36.23:443 -> 192.168.2.4:49732 version: TLS 1.2

System Summary

Abnormal high CPU Usage

Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe

Process Stats: CPU usage > 49%

Detected potential crypto function

Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Code function: 0_2_00EF5010	0_2_00EF5010
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Code function: 0_2_00EF3D60	0_2_00EF3D60
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00BFC01F	1_2_00BFC01F
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00C001A6	1_2_00C001A6
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00C0A28E	1_2_00C0A28E
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00BD62CC	1_2_00BD62CC
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00C00461	1_2_00C00461
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00C02413	1_2_00C02413
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00C02642	1_2_00C02642
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00C0E73C	1_2_00C0E73C
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00BFF8C3	1_2_00BFF8C3
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00BFFC35	1_2_00BFFC35
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00C09DE0	1_2_00C09DE0
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00BFFEDF	1_2_00BFFEDF
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00BF3F71	1_2_00BF3F71
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_0020C01F	2_2_0020C01F
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_002101A6	2_2_002101A6
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_0021A28E	2_2_0021A28E
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_001E62CC	2_2_001E62CC
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_00212413	2_2_00212413
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_00210461	2_2_00210461
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_00212642	2_2_00212642
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_0021E73C	2_2_0021E73C
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_0020F8C3	2_2_0020F8C3
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_0020FC35	2_2_0020FC35
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_00219DE0	2_2_00219DE0
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_0020FEDF	2_2_0020FEDF
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_00203F71	2_2_00203F71
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06DBE8E1	2_2_06DBE8E1
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06DB5483	2_2_06DB5483
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06DBD083	2_2_06DBD083
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06DB7043	2_2_06DB7043
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06DBEA67	2_2_06DBEA67
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06DBC722	2_2_06DBC722
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_6D007117	2_2_6D007117
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_6D012918	2_2_6D012918
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_6D00DD2E	2_2_6D00DD2E
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_6D00D880	2_2_6D00D880
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_6D006EE8	2_2_6D006EE8
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_03C2E248	2_2_03C2E248
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_03C2D9F8	2_2_03C2D9F8
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_03C22C18	2_2_03C22C18
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_03C22C28	2_2_03C22C28
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06591570	2_2_06591570
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06595F80	2_2_06595F80
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_0659BBC0	2_2_0659BBC0
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_0659E2D0	2_2_0659E2D0
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_0659E2C0	2_2_0659E2C0
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06595F73	2_2_06595F73
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_0659FB10	2_2_0659FB10
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_0659FB00	2_2_0659FB00
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_0659BBB3	2_2_0659BBB3
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06B41A63	2_2_06B41A63
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06DDC9A0	2_2_06DDC9A0
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_07699D27	2_2_07699D27
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06DB3339	2_2_06DB3339

Found potential string decryption / allocating functions

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: String function: 00C12B5D appears 79 times
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: String function: 00C0FFF0 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: String function: 00BD38BA appears 501 times
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: String function: 00BD2022 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: String function: 00C0FB09 appears 683 times
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: String function: 00222B5D appears 78 times
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: String function: 0021FB09 appears 681 times
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: String function: 001E38BA appears 496 times
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: String function: 0021FFF0 appears 34 times
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: String function: 001E2022 appears 54 times

Tries to load missing DLLs

Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: iconcodecservice.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: msctfui.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Section loaded: d3dcompiler_47.dll	Jump to behavior

Uses 32bit PE files

Source: TsU2RShnl7.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: AdGuard.CrashReporter.dll.2.dr, J9RBZrcFuXjtKQ36hEp.cs	Cryptographic APIs: 'CreateDecryptor'
Source: AdGuard.CrashReporter.dll.2.dr, J9RBZrcFuXjtKQ36hEp.cs	Cryptographic APIs: 'CreateDecryptor'
Source: AdGuard.CrashReporter.dll.2.dr, J9RBZrcFuXjtKQ36hEp.cs	Cryptographic APIs: 'CreateDecryptor'
Source: AdGuard.CrashReporter.dll.2.dr, J9RBZrcFuXjtKQ36hEp.cs	Cryptographic APIs: 'CreateDecryptor'

Source: classification engine

Classification label: mal42.troj.evad.winEXE@5/95@3/1

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 1_2_00BD2078 FormatMessageW,GetLastError,LocalFree,

1_2_00BD2078

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00BD4639 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,		1_2_00BD4639
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_001E4639 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,		2_2_001E4639

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 1_2_00C128BD GetModuleHandleA,GetLastError,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CoCreateInstance,ExitProcess,

1_2_00C128BD

Source: C:\Users\user\Desktop\TsU2RShnl7.exe

Code function: 0_2_00EF9998 GetModuleHandleW,FindResourceW,SizeofResource,LoadResource,LockResource,

0_2_00EF9998

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 1_2_00BF68EE ChangeServiceConfigW,GetLastError,

1_2_00BF68EE

Source: C:\Users\user\Desktop\TsU2RShnl7.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\installer[1].exe

Jump to behavior

Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Mutant created: NULL
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Mutant created: \Sessions\1\BaseNamedObjects\AdguardVpnInstaller_F23CB6CB-327E-4BB5-B9DF-7062501506B8
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\AdguardVpnBurn_UI_F23CB6CB-C5F8-47BA-B854-DB660C1500BB

Source: C:\Users\user\Desktop\TsU2RShnl7.exe

File created: C:\Users\user\AppData\Local\Temp\adguard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: cabinet.dll	1_2_00BD1070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: msi.dll	1_2_00BD1070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: version.dll	1_2_00BD1070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: wininet.dll	1_2_00BD1070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: comres.dll	1_2_00BD1070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: clbcatq.dll	1_2_00BD1070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: msasn1.dll	1_2_00BD1070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: crypt32.dll	1_2_00BD1070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: feclient.dll	1_2_00BD1070
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Command line argument: cabinet.dll	1_2_00BD1070
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Command line argument: cabinet.dll	2_2_001E1070
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Command line argument: msi.dll	2_2_001E1070
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Command line argument: version.dll	2_2_001E1070
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Command line argument: wininet.dll	2_2_001E1070
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Command line argument: comres.dll	2_2_001E1070
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Command line argument: clbcatq.dll	2_2_001E1070
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Command line argument: msasn1.dll	2_2_001E1070
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Command line argument: crypt32.dll	2_2_001E1070
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Command line argument: feclient.dll	2_2_001E1070

Source: TsU2RShnl7.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\TsU2RShnl7.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE [__preferences] ( [key] TEXT NOT NULL, [type] TEXT NOT NULL, [value] >, PRIMARY KEY ([key], [type]));x@{0}({1} {2} Autoincrement={3} NullValue={4} StartValue={5})\|Cannot build this statement for table without primary key for
Source: setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SELECT name FROM sqlite_master WHERE type='table' AND name='__preferences';LPreference table exists, doing nothingdThe database schema has been successfully verified

Source: setup.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: setup.exe	String found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: setup.exe	String found in binary or memory: http://static.adguard.com/installer.v1.0.json
Source: setup.exe	String found in binary or memory: views/installprogress.baml
Source: setup.exe	String found in binary or memory: /reinstall
Source: setup.exe	String found in binary or memory: views/installsetting.baml
Source: setup.exe	String found in binary or memory: /AdGuardVpn.Burn;component/views/installprogress.xaml
Source: setup.exe	String found in binary or memory: /AdGuardVpn.Burn;component/views/installsetting.xaml
Source: setup.exe	String found in binary or memory: t in-addr.arpa in-the-band.net in.na in.net in.rs in.th in.ua in.us ina.ibaraki.jp ina.nagano.jp ina.saitama.jp inabe.mie.jp inagawa.hyogo.jp inagi.tokyo.jp inami.toyama.jp inami.wakayama.jp inashiki.ibaraki.jp inatsuki.fukuoka.jp inawashiro
Source: TsU2RShnl7.exe	String found in binary or memory: https_url http://static.adguardvpn.com/windows/installer.exe
Source: TsU2RShnl7.exe	String found in binary or memory: http_url https://static.adguardvpn.com/windows/installer.exe
Source: TsU2RShnl7.exe	String found in binary or memory: A`~@https_url http://static.adguardvpn.com/windows/installer.exe

Source: unknown	Process created: C:\Users\user\Desktop\TsU2RShnl7.exe C:\Users\user\Desktop\TsU2RShnl7.exe
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Process created: C:\Users\user\AppData\Local\Temp\adguard\setup.exe C:\Users\user\AppData\Local\Temp\adguard\setup.exe "AID=31220"
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Process created: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=708 -burn.filehandle.self=744 "AID=31220
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Process created: C:\Users\user\AppData\Local\Temp\adguard\setup.exe C:\Users\user\AppData\Local\Temp\adguard\setup.exe "AID=31220"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Process created: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=708 -burn.filehandle.self=744 "AID=31220	Jump to behavior

Source: C:\Users\user\Desktop\TsU2RShnl7.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE / OLE file has a valid certificate

Source: TsU2RShnl7.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: TsU2RShnl7.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: AdGuard.Utils.Base.pdb source: setup.exe, setup.exe, 00000002.00000002.4135043337.0000000006632000.00000002.00000001.01000000.00000011.sdmp, setup.exe, 00000002.00000002.4148412119.000000000E4BC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: ndows\dll\System.pdb source: setup.exe, 00000002.00000002.4129180636.0000000000B18000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: //.pdb source: setup.exe, 00000002.00000002.4148412119.000000000E4BC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mDC:\Windows\AdGuard.Utils.Base.pdb source: setup.exe, 00000002.00000002.4148412119.000000000E4BC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: AdGuard.Utils.Base.pdb3693405117-2476756634-1002_Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver3215ebb53fac1131ae0bd333c5ee6021672d9718ea31a8aebd0da0072f25d87dba6fc90ffd598ed4da35e44c398c454307e8e33b8426143daec9f596836f97c8f747 source: setup.exe, 00000002.00000002.4144647270.000000000D0D3000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Bamboo\bamboo-agent-home\xml-data\build-dir\WIN-BVR4-JOB1\AdGuardVpn\Installer\AdGuardVpn.Burn\obj\Release\AdGuardVpn.Burn.pdb\ source: setup.exe, 00000002.00000002.4134466876.00000000063EA000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: C:\Users\Bamboo\bamboo-agent-home\xml-data\build-dir\WIN-BVR4-JOB1\AdGuardVpn\Installer\AdGuardVpn.Burn\obj\Release\AdGuardVpn.Burn.pdb source: setup.exe, setup.exe, 00000002.00000002.4134466876.00000000063EA000.00000002.00000001.01000000.0000000F.sdmp
Source:	Binary string: AdGuard.Utils.pdb source: setup.exe, setup.exe, 00000002.00000002.4136698136.0000000006B52000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: \??\C:\Windows\dll\AdGuard.Utils.Base.pdb` source: setup.exe, 00000002.00000003.3971391682.000000000D0EE000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: AdGuard.CrashReporter.pdbxE source: setup.exe, 00000002.00000002.4138160484.0000000006F22000.00000002.00000001.01000000.00000014.sdmp, AdGuard.CrashReporter.dll.2.dr
Source:	Binary string: symbols\dll\AdGuard.Utils.Base.pdb source: setup.exe, 00000002.00000002.4148412119.000000000E4BC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: AdGuard.CrashReporter.pdb source: setup.exe, setup.exe, 00000002.00000002.4138160484.0000000006F22000.00000002.00000001.01000000.00000014.sdmp, AdGuard.CrashReporter.dll.2.dr
Source:	Binary string: C:\raven\build\obj\Release\net45\SharpRaven.pdb source: setup.exe, setup.exe, 00000002.00000002.4137257641.0000000006DB2000.00000002.00000001.01000000.00000015.sdmp
Source:	Binary string: AdGuard.Utils.UI.pdb source: setup.exe, setup.exe, 00000002.00000002.4137906412.0000000006E82000.00000002.00000001.01000000.00000013.sdmp
Source:	Binary string: C:\Development\Releases\Json\Working\Newtonsoft.Json\Working-Signed\Src\Newtonsoft.Json\obj\Release\net45\Newtonsoft.Json.pdb source: setup.exe, setup.exe, 00000002.00000002.4140662194.0000000007692000.00000002.00000001.01000000.00000016.sdmp, Newtonsoft.Json.dll.2.dr
Source:	Binary string: mC:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.Base.pdb source: setup.exe, 00000002.00000002.4148412119.000000000E4BC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: AdGuard.Utils.Base.pdbs.Base.pdbpdbase.pdbFD8B648}\.ba\AdGuard.Utils.Base.pdb source: setup.exe, 00000002.00000002.4148412119.000000000E4BC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\mbahost.pdb source: setup.exe, 00000002.00000002.4148565608.000000006D014000.00000002.00000001.01000000.0000000C.sdmp, mbahost.dll.2.dr
Source:	Binary string: C:\Users\Bamboo\bamboo-agent-home\xml-data\build-dir\WIN-BWU-JOB1\AdGuard.Commons\build\obj\Release\AdGuard.Utils.Installer\AdGuard.Utils.Installer.pdb source: setup.exe, setup.exe, 00000002.00000002.4134315843.0000000006382000.00000002.00000001.01000000.00000010.sdmp, AdGuard.Utils.Installer.dll.2.dr
Source:	Binary string: C:\agent\_work\66\s\build\ship\x86\burn.pdb source: setup.exe, 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000001.00000000.1681263492.0000000000C1A000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000000.1685299582.000000000022A000.00000002.00000001.01000000.0000000B.sdmp, setup.exe, 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmp, setup.exe.0.dr
Source:	Binary string: m.pdb source: setup.exe, 00000002.00000002.4148412119.000000000E4BC000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\agent\_work\66\s\build\obj\ship\x86\core\BootstrapperCore.pdb source: setup.exe, setup.exe, 00000002.00000002.4133924301.0000000005F82000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.2.dr
Source:	Binary string: C:\raven\build\obj\Release\net45\SharpRaven.pdbSHA256 source: setup.exe, 00000002.00000002.4137257641.0000000006DB2000.00000002.00000001.01000000.00000015.sdmp

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: AdGuard.CrashReporter.dll.2.dr, J9RBZrcFuXjtKQ36hEp.cs

.Net Code: Type.GetTypeFromHandle(YIMquUNSDMGy86DB5mg.bmQa6K98iO(16777377)).GetMethod("GetDelegateForFunctionPointer", new Type[2]{Type.GetTypeFromHandle(YIMquUNSDMGy86DB5mg.bmQa6K98iO(16777252)),Type.GetTypeFromHandle(YIMquUNSDMGy86DB5mg.bmQa6K98iO(16777255))})

Binary contains a suspicious time stamp

Source: AdGuardVpn.Burn.dll.2.dr

Static PE information: 0xCB466F45 [Wed Jan 26 02:47:33 2078 UTC]

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\TsU2RShnl7.exe

Code function: 0_2_00EF14F0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00EF14F0

PE file contains sections with non-standard names

Source: TsU2RShnl7.exe	Static PE information: section name: .eh_fram
Source: installer[1].exe.0.dr	Static PE information: section name: .wixburn
Source: setup.exe.0.dr	Static PE information: section name: .wixburn
Source: setup.exe.1.dr	Static PE information: section name: .wixburn

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Code function: 0_2_00EF9998 push edx; mov dword ptr [esp], eax	0_2_00EF99FC
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Code function: 0_2_00EF8170 push ecx; mov dword ptr [esp], ebx	0_2_00EF88F8
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Code function: 0_2_00EF8170 push eax; mov dword ptr [esp], ebx	0_2_00EF8947
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Code function: 0_2_00EFB55C push eax; mov dword ptr [esp], ebx	0_2_00EFB597
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Code function: 0_2_00EFB6A8 push ecx; mov dword ptr [esp], eax	0_2_00EFBA6C
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Code function: 0_2_00EFB6A8 push ebx; mov dword ptr [esp], 00000005h	0_2_00EFBE95
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Code function: 0_2_00EFB6A8 push edx; mov dword ptr [esp], eax	0_2_00EFBF78
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Code function: 0_2_00EF8E34 push edx; mov dword ptr [esp], edi	0_2_00EF90EE
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Code function: 0_2_00EFF8E2 push ecx; ret	0_2_00EFF8E3
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00BFE806 push ecx; ret	1_2_00BFE819
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_0020E806 push ecx; ret	2_2_0020E819
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06383A07 push es; iretd	2_2_063839E2
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06383A07 push es; retf 0000h	2_2_06383A42
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06383A65 push es; retf 0000h	2_2_06383A42
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06383A65 push es; retf	2_2_06383A62
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06383A47 push es; retf	2_2_06383A62
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06383907 push es; retn 0000h	2_2_06383922
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_063839CA push es; iretd	2_2_063839E2
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_063C7C6A push cs; retn 000Eh	2_2_063C7C96
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_063C7A4E push ss; retn 000Eh	2_2_063C7A5C
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_063C7CBE push ds; retn 000Eh	2_2_063C7CC6
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_063C7CAC push cs; retn 000Eh	2_2_063C7CBA
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_063C7B99 push 00000014h; retn 000Eh	2_2_063C7BA6
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_063C7BED push ds; retn 000Eh	2_2_063C7C66
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06DBE5ED push cs; retf	2_2_06DBE5F0
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06DBDFA9 push es; retf	2_2_06DBE164
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06DBEA5F push ss; retf	2_2_06DBEA64
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06DBE14D push es; retf	2_2_06DBE164
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06DBE625 push cs; retf	2_2_06DBE626
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06F24364 push edi; ret	2_2_06F24367
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_06F28F42 push edi; ret	2_2_06F28F43

Source: AdGuard.CrashReporter.dll.2.dr, ExtendedRavenClient.cs	High entropy of concatenated method names: 'CreateJsonPacket', 'Capture', 'xwE2y4oJoWOsXoM0itQ', 'Oi8gcGobOFk0gYxn55i', 'PgiO8CoRJQPxhtfxrSI', 'dCwVs7on60MHZS190B1', 'URguL7o4oSaIKC8buoH', 'i51C0goOYfLJFTcANQY', 'camIEJo1HtHuSgfqsRW', 'CgtitAoHGc7f5Dw747c'
Source: AdGuard.CrashReporter.dll.2.dr, CrashReportService.cs	High entropy of concatenated method names: 'OBRL9WKQG', 'HandleException', 'OnAttributesAdding', 'OnAfterSending', 'OnTagsAdding', 'OnCrashInfoCreating', 'mG7YUBt8J', 'mK2ow3Hdx', 'qoISHlxGj', 'ShowCrashReportDialog'
Source: AdGuard.CrashReporter.dll.2.dr, ProgramCrashReportService.cs	High entropy of concatenated method names: 'xeoZwF9Sy', 'OnCrashInfoCreating', 'ShowCrashReportDialog', 'SendCrashInfo', 'pTGdORJUF', 'OnTagsAdding', 'OnAttributesAdding', 'OnAfterSending', 'JfD7vpxQY', 'snM2wh8XM'
Source: AdGuard.CrashReporter.dll.2.dr, InstallerCrashReportService.cs	High entropy of concatenated method names: 'OnAttributesAdding', 'ShowCrashReportDialog', 'OnCrashInfoCreating', 'SendCrashInfo', 'kwDGQ128g', 'dnVP5uu56', 'rsbXZvN5v', 'G9Ra1bYUP7C3mAusRKr', 'LmLN5yYeUNvja5UhAZs', 'A0L2OfYQvQ0YF8OWgaW'
Source: AdGuard.CrashReporter.dll.2.dr, wkUMI4wthRvjU88fHDZ.cs	High entropy of concatenated method names: 'KcNwcrv9NQ', 'IIgwKVqIUr', 'eEWwN1rNtT', 'DggwTek5Lm', 'ooJwhevvJy', 'rnMwuTt09i', 'rkowp3UxvL', 'OARlHBot5kMbM91nOis', 'TmY7tTYI3R39LgHK7dh', 'EL4ylUYzV3fNdvjP9pB'
Source: AdGuard.CrashReporter.dll.2.dr, J9RBZrcFuXjtKQ36hEp.cs	High entropy of concatenated method names: 'mgcGEASG55JUc5Iq7U2', 'qJGHv3SP57EOIDQhB3p', 'ce4DmfsmSrOT856tDgfrkMb', 'DOmNcnHSbd', 'wjPwNWSdTU2f1eXjak2', 'h3ERA6S7QIaMq1OW1Qb', 'FuKNKHS2dhYcKebJmY9', 'PsryA6S5f0FeP5esyOf', 'Liom1HSvtDo3cpLuOV4', 'DJ4Pr2SCQqBOIjNLq2a'
Source: AdGuard.CrashReporter.dll.2.dr, qL3tcvNOKaRFqI9Sx1D.cs	High entropy of concatenated method names: 'rO2D9h9psh', 'bogDDPjnnu', 'BeMDroN9tI', 'CxLDiRLtTe', 'M1EDEA7snn', 'nPaDeNAuEf', 'hftDQ8oVQv', 'dkBTexf5wo', 'SHVDUaliJ1', 'XRNDA3um6F'

Persistence and Installation Behavior

Drops PE files

Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\hy\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.pl.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\mbahost.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\be\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.fr.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\zh-TW\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\sl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.da.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuardVpn.Burn.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.ja.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\zh\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\id\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\hr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\pl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\es\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\hu\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\da\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\de\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ro\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.ru.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.Installer.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.CrashReporter.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\pt-BR\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\sr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.nl.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ko\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.es.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\uk\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ar\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\fa\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.ko.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.sl.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\SharpRaven.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.zh-TW.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	File created: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.it.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\tr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.sk.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\mbapreq.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.tr.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.UI.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.cs.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.de.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.pt-PT.dll	Jump to dropped file
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\installer[1].exe	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\nl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	File created: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.Base.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.pt.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\bg\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ru\AdGuardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\it\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ja\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\BootstrapperCore.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.zh.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\he\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\fr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\pt-PT\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\no\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\vi\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\cs\AdguardVpn.Burn.resources.dll	Jump to dropped file

Drops PE files to the windows directory (C:\Windows)

Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\hy\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.pl.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\mbahost.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\be\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.fr.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\zh-TW\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\sl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.da.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuardVpn.Burn.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.ja.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\zh\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\id\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\hr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\pl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\es\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\hu\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\da\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\de\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ro\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.ru.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.Installer.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.CrashReporter.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\pt-BR\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\sr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.nl.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ko\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.es.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\uk\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ar\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\fa\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.ko.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.sl.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\SharpRaven.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.zh-TW.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	File created: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.it.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\tr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.sk.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\mbapreq.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.tr.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.UI.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.cs.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.de.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.pt-PT.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\nl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.Base.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.pt.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\bg\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ru\AdGuardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\it\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ja\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\BootstrapperCore.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.zh.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\he\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\fr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\pt-PT\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\no\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\vi\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	File created: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\cs\AdguardVpn.Burn.resources.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Memory allocated: 2AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Memory allocated: 3D60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Memory allocated: 5D60000 memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86400000	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86399859	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86399750	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86399640	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86399530	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86399406	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86399297	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86399187	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86399078	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86398969	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86398859	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86398750	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86398623	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86398515	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86398406	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86398297	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86398187	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86398078	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86397969	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86397859	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86397750	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86397641	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86397516	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86397391	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 599859	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 599750	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 599640	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 599421	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 599181	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 599062	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 598948	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 598828	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 598718	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 598390	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 598276	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 598047	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 597608	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 596850	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 596406	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Window / User API: threadDelayed 2684			Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Window / User API: threadDelayed 6252			Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\hy\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.pl.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\mbahost.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\be\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.fr.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\zh-TW\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\sl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.da.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuardVpn.Burn.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.ja.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\zh\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\id\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\System.Data.SQLite.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\hr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\System.Runtime.InteropServices.RuntimeInformation.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\pl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\es\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\hu\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\da\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\de\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ro\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.ru.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.CrashReporter.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\pt-BR\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.Installer.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\sr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.nl.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ko\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.es.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\uk\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ar\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\fa\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.ko.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.sl.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\SharpRaven.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.zh-TW.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.it.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.sk.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\tr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\mbapreq.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.tr.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.UI.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.cs.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.de.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.pt-PT.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\nl\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.Base.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.pt.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\bg\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ru\AdGuardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\it\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ja\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\BootstrapperCore.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.zh.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\fr\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\he\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\no\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\pt-PT\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\cs\AdguardVpn.Burn.resources.dll	Jump to dropped file
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Dropped PE file which has not been started: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\vi\AdguardVpn.Burn.resources.dll	Jump to dropped file

Found evasive API chain (date check)

Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe

Evasive API call chain: GetLocalTime,DecisionNodes

Found evasive API chain checking for process token information

Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Check user administrative privileges: GetTokenInformation,DecisionNodes

Found large amount of non-executed APIs

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

API coverage: 9.2 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -12912720851596678s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86400000s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86399859s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86399750s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86399640s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86399530s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86399406s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86399297s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86399187s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86399078s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86398969s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86398859s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86398750s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86398623s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86398515s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86398406s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86398297s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86398187s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86398078s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86397969s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86397859s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86397750s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86397641s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86397516s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -86397391s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -599859s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -599750s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -599640s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -599531s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -599421s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -599312s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -599181s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -599062s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -598948s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -598828s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -598718s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -598609s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -598500s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -598390s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -598276s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -598156s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -598047s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -597937s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -597828s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -597719s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -597608s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -597437s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -597265s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -597125s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -597000s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -596850s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -596734s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -596625s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -596515s >= -30000s	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe TID: 7300	Thread sleep time: -596406s >= -30000s	Jump to behavior

Uses the system / local time for branch decision (may execute only at specific dates)

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00C0F79E GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00C0F839h	1_2_00C0F79E
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00C0F79E GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00C0F832h	1_2_00C0F79E
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_0021F79E GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 0021F839h	2_2_0021F79E
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_0021F79E GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 0021F832h	2_2_0021F79E

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00BE9A1D FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	1_2_00BE9A1D
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00C13C72 FindFirstFileW,FindClose,	1_2_00C13C72
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00BD3D4E GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,	1_2_00BD3D4E
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_001F9A1D FindFirstFileW,lstrlenW,FindNextFileW,FindClose,	2_2_001F9A1D
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_00223C72 FindFirstFileW,FindClose,	2_2_00223C72

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 1_2_00C18EF4 VirtualQuery,GetSystemInfo,

1_2_00C18EF4

Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86400000	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86399859	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86399750	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86399640	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86399530	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86399406	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86399297	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86399187	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86399078	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86398969	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86398859	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86398750	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86398623	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86398515	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86398406	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86398297	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86398187	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86398078	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86397969	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86397859	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86397750	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86397641	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86397516	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 86397391	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 599859	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 599750	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 599640	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 599531	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 599421	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 599312	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 599181	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 599062	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 598948	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 598828	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 598718	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 598609	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 598500	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 598390	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 598276	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 598156	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 598047	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 597937	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 597828	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 597719	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 597608	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 597437	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 597265	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 597125	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 597000	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 596850	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 596734	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 596625	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 596515	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Thread delayed: delay time: 596406	Jump to behavior

Source: TsU2RShnl7.exe, 00000000.00000003.1682085182.00000000010FC000.00000004.00000020.00020000.00000000.sdmp, TsU2RShnl7.exe, 00000000.00000002.1683108457.00000000010FC000.00000004.00000020.00020000.00000000.sdmp, TsU2RShnl7.exe, 00000000.00000003.1671048827.00000000010FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: TsU2RShnl7.exe, 00000000.00000003.1682085182.000000000113A000.00000004.00000020.00020000.00000000.sdmp, TsU2RShnl7.exe, 00000000.00000003.1671048827.000000000113A000.00000004.00000020.00020000.00000000.sdmp, TsU2RShnl7.exe, 00000000.00000002.1683171456.000000000113A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: setup.exe, 00000002.00000003.1730418898.0000000006764000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1734164670.0000000006764000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1720719387.0000000006764000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1734034434.0000000006764000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.4135141369.000000000674F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll01

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	API call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	API call chain: ExitProcess graph end node

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 1_2_00C034A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

1_2_00C034A2

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\TsU2RShnl7.exe

Code function: 0_2_00EF14F0 GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00EF14F0

Contains functionality to read the PEB

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00C04104 mov eax, dword ptr fs:[00000030h]	1_2_00C04104
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_00214104 mov eax, dword ptr fs:[00000030h]	2_2_00214104
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_6D008FD6 mov eax, dword ptr fs:[00000030h]	2_2_6D008FD6

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\TsU2RShnl7.exe

Code function: 0_2_00EF8170 GetProcessHeap,strlen,HeapAlloc,memchr,memchr,memchr,memchr,HeapAlloc,HeapFree,GetLastError,HeapAlloc,GdiplusStartup,GetCurrentThreadId,GetDC,GetDeviceCaps,ReleaseDC,SystemParametersInfoW,GetModuleHandleW,LoadIconW,LoadCursorW,RegisterClassExW,SendMessageW,SendMessageW,SendMessageW,GetWindowLongW,SetWindowLongW,KiUserCallbackDispatcher,ShowWindow,GetLastError,CreateThread,KiUserCallbackDispatcher,GetParent,TranslateAcceleratorW,TranslateMessage,DispatchMessageW,WaitForSingleObject,GetExitCodeThread,CloseHandle,DeleteObject,DeleteObject,DeleteObject,GdiplusShutdown,GetModuleHandleW,UnregisterClassW,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,HeapFree,

0_2_00EF8170

Enables debug privileges

Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Code function: 0_2_00EF117C Sleep,Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,GetStartupInfoA,_cexit,_initterm,exit,	0_2_00EF117C
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Code function: 0_2_00EF11B3 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,	0_2_00EF11B3
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Code function: 0_2_00EF1170 Sleep,SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,	0_2_00EF1170
Source: C:\Users\user\Desktop\TsU2RShnl7.exe	Code function: 0_2_00EF13D1 SetUnhandledExceptionFilter,__p__acmdln,malloc,strlen,malloc,memcpy,__initenv,_amsg_exit,_initterm,	0_2_00EF13D1
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00BFE0A8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00BFE0A8
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00C034A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00C034A2
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00BFE574 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00BFE574
Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe	Code function: 1_2_00BFE707 SetUnhandledExceptionFilter,	1_2_00BFE707
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_0020E0A8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0020E0A8
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_002134A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_002134A2
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_0020E574 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_0020E574
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_0020E707 SetUnhandledExceptionFilter,	2_2_0020E707
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_6D00448C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6D00448C
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_6D007F77 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6D007F77
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Code function: 2_2_6D0042B6 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6D0042B6

Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Process created: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=708 -burn.filehandle.self=744 "AID=31220

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 1_2_00C10FA6 InitializeSecurityDescriptor,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,CreateWellKnownSid,GetLastError,SetEntriesInAclA,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree,

1_2_00C10FA6

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 1_2_00C132B9 AllocateAndInitializeSid,CheckTokenMembership,

1_2_00C132B9

Source: setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: Shell_TrayWnd

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 1_2_00BFE937 cpuid

1_2_00BFE937

Contains functionality to query locales information (e.g. system language)

Source: C:\Users\user\Desktop\TsU2RShnl7.exe

Code function: GetLocaleInfoW,GetWindowLongW,SetWindowLongW,ShowWindow,SendMessageW,SendMessageW,SendMessageW,CreateFontIndirectW,CreateSolidBrush,LoadImageW,SendMessageW,ShowWindow,ShowWindow,strlen,ShowWindow,LoadCursorW,SetWindowLongW,CreateFontIndirectW,SendMessageW,strlen,ShowWindow,

0_2_00EF93D8

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\BootstrapperCore.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuardVpn.Burn.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.Installer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.Base.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.UI.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.CrashReporter.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\SharpRaven.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\Newtonsoft.Json.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\segoeui.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework-SystemXml\v4.0_4.0.0.0__b77a5c561934e089\PresentationFramework-SystemXml.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Aero.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior
Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	Queries volume information: C:\Windows\Fonts\seguisb.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 1_2_00BE4E6A ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,GetLastError,CreateNamedPipeW,GetLastError,CloseHandle,LocalFree,

1_2_00BE4E6A

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 1_2_00BD605F GetSystemTime,GetDateFormatW,GetLastError,GetLastError,GetDateFormatW,GetLastError,

1_2_00BD605F

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 1_2_00BD6203 GetUserNameW,GetLastError,

1_2_00BD6203

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 1_2_00C18039 GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,

1_2_00C18039

Source: C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Code function: 1_2_00BD51D2 GetModuleHandleW,CoInitializeEx,GetVersionExW,GetLastError,CoUninitialize,

1_2_00BD51D2

Source: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

AV process strings found (often used to terminate AV products)

Source: setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bdagent.exe
Source: setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: avgrsx.exe
Source: setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AVKService.exe
Source: setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: avp.exe
Source: setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dwservice.exe
Source: setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AVKProxy.exe
Source: setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AVKTray.exe
Source: setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: avgcsrvx.exe
Source: setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dwengine.exe
Source: setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: avgui.exe
Source: setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ufnavi.exe
Source: setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: mbam.exe

Stealing of Sensitive Information

Yara detected PureLog Stealer

Source: Yara match	File source: 2.2.setup.exe.6e80000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.setup.exe.6f20000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.setup.exe.6630000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.setup.exe.6b50000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4135043337.0000000006632000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4137906412.0000000006E82000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4138160484.0000000006F22000.00000002.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4136698136.0000000006B52000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.Base.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.UI.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.CrashReporter.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.dll, type: DROPPED

Remote Access Functionality

Yara detected PureLog Stealer

Source: Yara match	File source: 2.2.setup.exe.6e80000.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.setup.exe.6f20000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.setup.exe.6630000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.setup.exe.6b50000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.4135043337.0000000006632000.00000002.00000001.01000000.00000011.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4137906412.0000000006E82000.00000002.00000001.01000000.00000013.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4138160484.0000000006F22000.00000002.00000001.01000000.00000014.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.4136698136.0000000006B52000.00000002.00000001.01000000.00000012.sdmp, type: MEMORY
Source: Yara match	File source: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.Base.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.UI.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.CrashReporter.dll, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.dll, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	12 System Time Discovery	Remote Services	11 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Command and Scripting Interpreter	1 Windows Service	1 Access Token Manipulation	11 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Service Execution	Logon Script (Windows)	1 Windows Service	2 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	13 Process Injection	1 Software Packing	NTDS	35 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	31 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	31 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Access Token Manipulation	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	13 Process Injection	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
TsU2RShnl7.exe	0%	ReversingLabs
TsU2RShnl7.exe	0%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\installer[1].exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\installer[1].exe	0%	Virustotal	Browse
C:\Users\user\AppData\Local\Temp\adguard\setup.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\adguard\setup.exe	0%	Virustotal	Browse
C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	0%	ReversingLabs
C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe	0%	Virustotal	Browse
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.CrashReporter.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.CrashReporter.dll	0%	Virustotal	Browse
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.Base.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.Base.dll	0%	Virustotal	Browse
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.Installer.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.Installer.dll	0%	Virustotal	Browse
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.UI.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.UI.dll	0%	Virustotal	Browse
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.dll	0%	Virustotal	Browse
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuardVpn.Burn.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuardVpn.Burn.dll	0%	Virustotal	Browse
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\BootstrapperCore.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\BootstrapperCore.dll	0%	Virustotal	Browse
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\Newtonsoft.Json.dll	0%	Virustotal	Browse
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\SharpRaven.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\System.Data.SQLite.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\System.Runtime.InteropServices.RuntimeInformation.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ar\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\be\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\bg\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\cs\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\da\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\de\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\es\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\fa\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\fr\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\he\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\hr\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\hu\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\hy\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\id\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\it\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ja\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ko\AdguardVpn.Burn.resources.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.cs.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.da.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.de.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.es.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.fr.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.it.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.ja.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.ko.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.nl.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.pl.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.pt-PT.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.pt.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.ru.dll	0%	ReversingLabs
C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.sk.dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
1523296349.rsc.cdn77.org	0%	Virustotal	Browse
1625341327.rsc.cdn77.org	0%	Virustotal	Browse
static.adguardvpn.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://sectigo.com/CPS0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	0%	URL Reputation	safe
http://ocsp.sectigo.com0	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	0%	URL Reputation	safe
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
http://appsyndication.org/2006/appsynapplicationc:	0%	URL Reputation	safe
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	0%	URL Reputation	safe
http://appsyndication.org/2006/appsyn	0%	URL Reputation	safe
https://dev.adguard.com&https://adguard.com	0%	Avira URL Cloud	safe
https://error.c.cdn77.org/	0%	Avira URL Cloud	safe
https://static.adguardvpn.com/windows/installer.exeZ	0%	Avira URL Cloud	safe
https://static.adguardvpn.com/windows/installer.exeK	0%	Avira URL Cloud	safe
http://static.adguardvpn.com/windows/installer.exe	0%	Avira URL Cloud	safe
http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exe	0%	Avira URL Cloud	safe
http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exe4q	0%	Avira URL Cloud	safe
https://static.adguardvpn.com/	0%	Avira URL Cloud	safe
https://static.adguardvpn.com/windows/installer.exeK	0%	Virustotal		Browse
https://static.adguardvpn.com/windows/installer.exeZ	0%	Virustotal		Browse
https://link.adtidy.net	0%	Avira URL Cloud	safe
https://static.adguardvpn.com/	0%	Virustotal		Browse
http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exe	1%	Virustotal		Browse
https://static.adguardvpn.com/windows/installer.exen	0%	Avira URL Cloud	safe
http://sentry-dsn.invalid	0%	Avira URL Cloud	safe
https://error.c.cdn77.org/	0%	Virustotal		Browse
https://static.adguardvpn.com/windows/installer.exe	0%	Avira URL Cloud	safe
https://link.adtidy.net	1%	Virustotal		Browse
https://www.getsentry.com	0%	Avira URL Cloud	safe
https://static.adguardvpn.com/windows/installer.exe6	0%	Avira URL Cloud	safe
http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exe0	0%	Avira URL Cloud	safe
https://static.adguardvpn.com/windows/installer.exen	0%	Virustotal		Browse
https://static.adguardvpn.com/windows/installer.exe	0%	Virustotal		Browse
https://s10.adtidy.net:443/api/55/store/	0%	Avira URL Cloud	safe
http://static.adguardvpn.com/windows/installer.exe	0%	Virustotal		Browse
https://www.getsentry.com	0%	Virustotal		Browse
https://www.getsentry.com.	0%	Avira URL Cloud	safe
https://s10.adtidy.net:443/api/embed/error-page/	0%	Avira URL Cloud	safe
https://www.getsentry.com.	0%	Virustotal		Browse
https://static.adguardvpn.com/windows/installer.exe6	0%	Virustotal		Browse
http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exe0	0%	Virustotal		Browse
https://s10.adtidy.net:443/api/embed/error-page/	1%	Virustotal		Browse
https://s10.adtidy.net:443/api/55/store/	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
1523296349.rsc.cdn77.org	156.146.36.23	true	false	0%, Virustotal, Browse	unknown
1625341327.rsc.cdn77.org	156.146.36.23	true	false	0%, Virustotal, Browse	unknown
static.adguard.com	unknown	unknown	false		high
static.adguardvpn.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
time.windows.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://static.adguardvpn.com/windows/installer.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://static.adguard.com/installer.v1.0.json	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://static.adguardvpn.com/windows/installer.exe	TsU2RShnl7.exe	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://devvpn.adguard.com/.https://adguard-vpn.com.https://link.adtidy.net	setup.exe, 00000002.00000002.4134466876.00000000063C2000.00000002.00000001.01000000.0000000F.sdmp	false		high
https://static.adguardvpn.com/windows/installer.exeK	TsU2RShnl7.exe, 00000000.00000003.1682085182.0000000001112000.00000004.00000020.00020000.00000000.sdmp, TsU2RShnl7.exe, 00000000.00000002.1683108457.0000000001112000.00000004.00000020.00020000.00000000.sdmp, TsU2RShnl7.exe, 00000000.00000003.1671048827.0000000001112000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://sectigo.com/CPS0	TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	false	URL Reputation: safe	unknown
http://api.adguard.com/uninstall.html	setup.exe, 00000002.00000002.4134466876.00000000063C2000.00000002.00000001.01000000.0000000F.sdmp	false		high
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0	TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	false	URL Reputation: safe URL Reputation: safe	unknown
http://ocsp.sectigo.com0	TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	false	URL Reputation: safe	unknown
http://wixtoolset.org/schemas/thmutil/2010	setup.exe, 00000002.00000003.1693700250.0000000000AB5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.adguard.com&https://adguard.com	setup.exe, 00000002.00000002.4135043337.0000000006632000.00000002.00000001.01000000.00000011.sdmp	false	Avira URL Cloud: safe	low
http://wixtoolset.org/Whttp://wixtoolset.org/telemetry/v	setup.exe, 00000002.00000002.4133924301.0000000005F82000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.2.dr	false		high
https://error.c.cdn77.org/	setup.exe, 00000002.00000002.4132352595.0000000003E79000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	false	URL Reputation: safe	unknown
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	false	URL Reputation: safe	unknown
http://wixtoolset.org/news/	setup.exe, setup.exe, 00000002.00000002.4133924301.0000000005F82000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.2.dr	false		high
https://static.adguardvpn.com/windows/installer.exeZ	TsU2RShnl7.exe, 00000000.00000002.1682990739.000000000109E000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://kb.adguard.com/)	setup.exe, 00000001.00000002.4128532484.000000000097A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://james.newtonking.com/projects/json	Newtonsoft.Json.dll.2.dr	false	URL Reputation: safe	unknown
http://wixtoolset.org/releases/SCreating	setup.exe, 00000002.00000002.4133924301.0000000005F82000.00000002.00000001.01000000.0000000E.sdmp, BootstrapperCore.dll.2.dr	false		high
https://kb.adguard.com/	setup.exe, 00000001.00000002.4129843205.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000002.00000002.4131311874.0000000002D80000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000002.00000002.4129180636.0000000000A80000.00000004.00000020.00020000.00000000.sdmp	false		high
http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exe	setup.exe, 00000001.00000002.4129843205.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1693700250.0000000000AB5000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.4131311874.0000000002D80000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exe4q	setup.exe, 00000002.00000003.1693877181.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1693700250.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.4129180636.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.newtonsoft.com/jsonschema	Newtonsoft.Json.dll.2.dr	false		high
https://static.adguardvpn.com/	TsU2RShnl7.exe, 00000000.00000003.1671048827.0000000001112000.00000004.00000020.00020000.00000000.sdmp, TsU2RShnl7.exe, 00000000.00000002.1683171456.0000000001123000.00000004.00000020.00020000.00000000.sdmp, TsU2RShnl7.exe, 00000000.00000003.1682085182.0000000001122000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://wixtoolset.org/releases/	setup.exe	false		high
https://link.adtidy.net	setup.exe, setup.exe, 00000002.00000002.4134466876.00000000063C2000.00000002.00000001.01000000.0000000F.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static.adguardvpn.com/windows/installer.exen	TsU2RShnl7.exe, 00000000.00000002.1682990739.00000000010D4000.00000004.00000020.00020000.00000000.sdmp, TsU2RShnl7.exe, 00000000.00000003.1682262101.00000000010D4000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://sentry-dsn.invalid	setup.exe, setup.exe, 00000002.00000002.4137257641.0000000006DB2000.00000002.00000001.01000000.00000015.sdmp	false	Avira URL Cloud: safe	unknown
http://appsyndication.org/2006/appsynapplicationc:	setup.exe, 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000001.00000000.1681263492.0000000000C1A000.00000002.00000001.01000000.00000009.sdmp, setup.exe, 00000002.00000000.1685299582.000000000022A000.00000002.00000001.01000000.0000000B.sdmp, setup.exe, 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmp, setup.exe.0.dr	false	URL Reputation: safe	unknown
http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y	TsU2RShnl7.exe, AdGuard.CrashReporter.dll.2.dr, AdGuard.Utils.Installer.dll.2.dr, setup.exe.0.dr	false	URL Reputation: safe	unknown
http://wixtoolset.org	BootstrapperCore.dll.2.dr, mbahost.dll.2.dr	false		high
https://www.getsentry.com	setup.exe, setup.exe, 00000002.00000002.4137257641.0000000006DB2000.00000002.00000001.01000000.00000015.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://static.adguard.com/installer.v1.0.json=args	setup.exe, 00000002.00000002.4134315843.0000000006382000.00000002.00000001.01000000.00000010.sdmp, AdGuard.Utils.Installer.dll.2.dr	false		high
https://static.adguardvpn.com/windows/installer.exe6	TsU2RShnl7.exe, 00000000.00000002.1682990739.00000000010D4000.00000004.00000020.00020000.00000000.sdmp, TsU2RShnl7.exe, 00000000.00000003.1682262101.00000000010D4000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://wixtoolset.org/	setup.exe	false		high
http://wixtoolset.org/telemetry/v	setup.exe	false		high
http://static.adguard.org/WindowsInstaller-KB893803-v2-x86.exe0	setup.exe, 00000001.00000002.4128532484.000000000097A000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://s10.adtidy.net:443/api/55/store/	setup.exe, 00000002.00000002.4132352595.0000000003DED000.00000004.00000800.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://static.adguard.com	setup.exe, 00000002.00000002.4132352595.0000000003E79000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.nuget.org/packages/Newtonsoft.Json.Bson	Newtonsoft.Json.dll.2.dr	false		high
https://www.getsentry.com.	setup.exe, 00000002.00000002.4137257641.0000000006DB2000.00000002.00000001.01000000.00000015.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://adguard.com	setup.exe, 00000001.00000003.1682984758.00000000009CD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000001.00000003.1682872535.00000000009CD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000001.00000002.4128532484.00000000009CD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000001.00000002.4129843205.0000000002DD0000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000002.00000002.4131311874.0000000002D80000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1693877181.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000003.1693700250.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp, setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp, setup.exe, 00000002.00000002.4129180636.0000000000ADD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	setup.exe, 00000002.00000002.4132352595.0000000003DED000.00000004.00000800.00020000.00000000.sdmp	false		high
https://s10.adtidy.net:443/api/embed/error-page/	setup.exe, 00000002.00000002.4132352595.0000000003DED000.00000004.00000800.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://api.adguard.com/FDefault	setup.exe, 00000002.00000002.4132352595.0000000003E8D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://appsyndication.org/2006/appsyn	setup.exe	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
156.146.36.23	1523296349.rsc.cdn77.org	United States		60068	CDN77GB	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1407361
Start date and time:	2024-03-12 10:20:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 16m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	TsU2RShnl7.exe renamed because original name is a hash value
Original Sample Name:	443b3b9929156d71ed73e99850a671a89d4d0d38cc8acc7f286696dd4f24895e.exe
Detection:	MAL
Classification:	mal42.troj.evad.winEXE@5/95@3/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 87% Number of executed functions: 166 Number of non-executed functions: 272
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 168.61.215.74, 20.189.173.12
Excluded domains from analysis (whitelisted): self-events-data.trafficmanager.net, fs.microsoft.com, ocsp.digicert.com, onedscolprdwus11.westus.cloudapp.azure.com, slscr.update.microsoft.com, crl.comodoca.com, twc.trafficmanager.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTPS proxy raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:21:01	API Interceptor	7707946x Sleep call for process: setup.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
156.146.36.23	http://spacex-falcon.com	Get hash	malicious	Unknown	Browse
	https://u3475401.ct.sendgrid.net/ls/click?upn=u001.0-2BOjl-2BZg3Rqumxt-2BL7adNSm8oShdqLcKfe3phwTJM2sm2GgvhjDlDlifxUG2C9lGvkFx_BS-2FCGvsXme-2BolZM92Eoni-2FdtdMvSpGU1Lrwe4I6quydUxKPtzR8lyAmi7xMrMCMMIUNSXrpDIpqh-2FqvvAK2cGe6q-2B2YQnbfa5DfcPXKwHcqBYWlQBKyEBmOUvcM-2FV3SpgQ5DT8vuunLHHFJrV-2FlE1zhEvTw1NYwEfo-2BAUWZzvVzZdMJNITwE9aVRolXPoIqnd0gkznPM82I8tZ5vY6VQTwyoQURRvJM7Ykq6CcNXqibCj6vfSW1-2Ffbuta9t-2BFMxK	Get hash	malicious	Unknown	Browse
	https://www.Sunfest.com/tickets?squadup-promo=sun24group-discount	Get hash	malicious	Unknown	Browse
	http://www.sunfest.com/tickets?squadup-promo=sun24group-discount	Get hash	malicious	Unknown	Browse
	https://www.webtoon.xyz/	Get hash	malicious	Unknown	Browse
	http://boomba.club	Get hash	malicious	Unknown	Browse
	speke.msi	Get hash	malicious	Unknown	Browse
	https://groupfuturista.com/FODOX2024.6/	Get hash	malicious	Unknown	Browse
	https://shadebarandgrillorlando.com	Get hash	malicious	Unknown	Browse
	https://www.passwordboss.com/download/	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CDN77GB	https://cloudflare-32l.pages.dev/	Get hash	malicious	HTMLPhisher	Browse	89.187.187.19
	https://fnbo-alerts.org	Get hash	malicious	Unknown	Browse	89.187.187.15
	https://deutsche-post-infos.com/	Get hash	malicious	Unknown	Browse	89.187.187.20
	https://mail-chrono-post.com/steps/index2.php?n=	Get hash	malicious	Unknown	Browse	89.187.187.12
	9c23f857-b0b9-47d6-b664-47a3132066f4.exe	Get hash	malicious	Unknown	Browse	89.187.187.25
	https://nalders.uk/dq.PDF	Get hash	malicious	Unknown	Browse	89.187.167.2
	9c23f857-b0b9-47d6-b664-47a3132066f4.exe	Get hash	malicious	Unknown	Browse	89.187.187.15
	https://flow.page/communitywestcu.org	Get hash	malicious	Unknown	Browse	89.187.177.16
	http://spacex-falcon.com	Get hash	malicious	Unknown	Browse	89.187.177.16
	http://spacex-falcon.com	Get hash	malicious	Unknown	Browse	89.187.177.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	SecuriteInfo.com.BackDoor.SpyBotNET.25.31525.26336.exe	Get hash	malicious	Unknown	Browse	156.146.36.23
	SecuriteInfo.com.BackDoor.SpyBotNET.25.31525.26336.exe	Get hash	malicious	Unknown	Browse	156.146.36.23
	SecuriteInfo.com.Trojan.KillProc2.16811.26778.27406.exe	Get hash	malicious	Unknown	Browse	156.146.36.23
	SecuriteInfo.com.Trojan.KillProc2.16811.26778.27406.exe	Get hash	malicious	Unknown	Browse	156.146.36.23
	SecuriteInfo.com.Win32.TrojanX-gen.6000.9169.exe	Get hash	malicious	Unknown	Browse	156.146.36.23
	SecuriteInfo.com.Win32.TrojanX-gen.6000.9169.exe	Get hash	malicious	Unknown	Browse	156.146.36.23
	SecuriteInfo.com.Win32.TrojanX-gen.4983.29177.exe	Get hash	malicious	Unknown	Browse	156.146.36.23
	SecuriteInfo.com.Win32.TrojanX-gen.4983.29177.exe	Get hash	malicious	Unknown	Browse	156.146.36.23
	2ufAQoamb0.exe	Get hash	malicious	Njrat	Browse	156.146.36.23
	j6498ODgB6.exe	Get hash	malicious	PureLog Stealer, Xehook Stealer	Browse	156.146.36.23
37f463bf4616ecd445d4a1937da06e19	FYI 231214.vbs	Get hash	malicious	FormBook, GuLoader	Browse	156.146.36.23
	UPS Delivery.exe	Get hash	malicious	AgentTesla, GuLoader	Browse	156.146.36.23
	_6TB6MLA_README_.hta	Get hash	malicious	Unknown	Browse	156.146.36.23
	Scanned PO Copy.vbs	Get hash	malicious	FormBook, GuLoader	Browse	156.146.36.23
	DRAFT BILL OF LADING.PDF.vbs	Get hash	malicious	Azorult, GuLoader	Browse	156.146.36.23
	RFQ- Titan Machinery SRL2024100044-11RO.vbs	Get hash	malicious	FormBook, GuLoader	Browse	156.146.36.23
	payment_Adv.vbs	Get hash	malicious	Remcos, GuLoader	Browse	156.146.36.23
	SIN2400136001370224.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	156.146.36.23
	Scanned PO Copy.vbs	Get hash	malicious	FormBook, GuLoader	Browse	156.146.36.23
	ETD 0303 DOCUMENT.vbs	Get hash	malicious	Remcos, GuLoader	Browse	156.146.36.23

Process:	C:\Users\user\Desktop\TsU2RShnl7.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	27862776
Entropy (8bit):	7.996404999321205
Encrypted:	true
SSDEEP:	786432:rlhnKJWt1S54gjfGAeci9YiS7ZqLCXxMyoI:3n+WbkFDGAec8RStqSxjoI
MD5:	0F6253C9F6113590AC12E665670E5870
SHA1:	333168F78DD6F993BACF2FF2016B7A413D610E62
SHA-256:	10D4AFF4AA11E477AEC5A348B0983A1CE272E6A3639607A6CAD2CB19830C251F
SHA-512:	4224EE58D165D11E8B54C999E4A3D091194EBB33FE6F8AE353B2D4A11C5D0472F62B3C19D84A8103821EF0119033F5FD39D65FF178AF8C30C94BD8B401D2E284
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.o.}k..}k..}k.....wk......k.....ek../...nk../...ik../...Vk..t...xk..t...lk..}k..(j......6k......\|k..}k...k......\|k..Rich}k..........PE..L...2p.].....................*......q.............@..................................8....@.............................................T........... ....,.......=..0p..T....................p.......j..@...................4\|.......................text............................... ..`.rdata..`...........................@..@.data...............................@....wixburn8...........................@..@.rsrc...T...........................@..@.reloc...=.......>..................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\AdGuardVPN_20240312102059.log

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	ASCII text, with very long lines (336), with CRLF line terminators
Category:	dropped
Size (bytes):	17004
Entropy (8bit):	5.470694025251751
Encrypted:	false
SSDEEP:	192:D4OHgFx7dSNcW6WzkGfVPkKNkD1h8TKHrul+IC7dCSVStdx9101f1n1I1hx9101W:DTHIVGyjo+IrtdxlxgxVxc
MD5:	09997F9129DA86F7771397B9825A26E3
SHA1:	120574921A951FB87B8E6CB68EBB0A4D477284C7
SHA-256:	C5FE2735EEE1A6EF7364178CF58861CA9E444293ED7D0E1D8274D43773397A54
SHA-512:	060E970EF9D34F56CC3CB3966B937524E8D85656553BAC3443520D4FA4E7DDD6ACF402BD2C300D9B597340CC513680F24DCB3AD3A38A0D70F27486BA376BFE4F
Malicious:	false
Reputation:	low
Preview:	[1C3C:1C40][2024-03-12T10:20:58]i001: Burn v3.11.2.4516, Windows v10.0 (Build 19045: Service Pack 0), path: C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe..[1C3C:1C40][2024-03-12T10:20:58]i000: Initializing string variable 'AID' to value ''..[1C3C:1C40][2024-03-12T10:20:58]i000: Initializing string variable 'CID' to value ''..[1C3C:1C40][2024-03-12T10:20:58]i000: Initializing string variable 'REMOVE_SETTINGS' to value 'NO'..[1C3C:1C40][2024-03-12T10:20:58]i000: Initializing string variable 'SHOW_UNINSTALL_PAGE' to value 'YES'..[1C3C:1C40][2024-03-12T10:20:58]i000: Initializing string variable 'NORUN' to value ''..[1C3C:1C40][2024-03-12T10:20:58]i000: Initializing string variable 'INSTALLDESKTOPSHORTCUT' to value ''..[1C3C:1C40][2024-03-12T10:20:58]i000: Initializing string variable 'INSTALLLOCATION' to value ''..[1C3C:1C40][2024-03-12T10:20:58]i000: Initializing string variable 'BUNDLE_KEY' to value '[WixBundleProviderKey]'..[1C3C:1C40][2024-03-12T10:20:58]i000: I

C:\Users\user\AppData\Local\Temp\adguard\setup.exe

Download File

Process:	C:\Users\user\Desktop\TsU2RShnl7.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	27862776
Entropy (8bit):	7.996404999321205
Encrypted:	true
SSDEEP:	786432:rlhnKJWt1S54gjfGAeci9YiS7ZqLCXxMyoI:3n+WbkFDGAec8RStqSxjoI
MD5:	0F6253C9F6113590AC12E665670E5870
SHA1:	333168F78DD6F993BACF2FF2016B7A413D610E62
SHA-256:	10D4AFF4AA11E477AEC5A348B0983A1CE272E6A3639607A6CAD2CB19830C251F
SHA-512:	4224EE58D165D11E8B54C999E4A3D091194EBB33FE6F8AE353B2D4A11C5D0472F62B3C19D84A8103821EF0119033F5FD39D65FF178AF8C30C94BD8B401D2E284
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.o.}k..}k..}k.....wk......k.....ek../...nk../...ik../...Vk..t...xk..t...lk..}k..(j......6k......\|k..}k...k......\|k..Rich}k..........PE..L...2p.].....................*......q.............@..................................8....@.............................................T........... ....,.......=..0p..T....................p.......j..@...................4\|.......................text............................... ..`.rdata..`...........................@..@.data...............................@....wixburn8...........................@..@.rsrc...T...........................@..@.reloc...=.......>..................@..B........................................................................................................................................................................................................................................................

C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\adguard\setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3149056
Entropy (8bit):	7.875476131556315
Encrypted:	false
SSDEEP:	49152:cT2pZ1ONwL0qpcaB699y44UzNmfuAu7OQKXmB72MV+gnLgvIV:cT02NwLvpcawr4AMflQKXmZ3VrLcIV
MD5:	BCAB2557997868A7B0E6DFE214A48969
SHA1:	2BC9B037E19ACB27F7D1C94588CA7393BFB25114
SHA-256:	E6C273C257E4F5957422F11028879BE4CC30C2D4CA6CD1D47FE3C9F2282904E1
SHA-512:	F45509DA76B0D7E346D6A78457DE138ECAF37D4E05EA702829398B80052211451A2C091E8B71DC099B6F098970E3E4678365CCF0B78E6A36B45E08E110678F92
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.o.}k..}k..}k.....wk......k.....ek../...nk../...ik../...Vk..t...xk..t...lk..}k..(j......6k......\|k..}k...k......\|k..Rich}k..........PE..L...2p.].....................*......q.............@..................................50...@.............................................T...........(./..,.......=..0p..T....................p.......j..@...................4\|.......................text............................... ..`.rdata..`...........................@..@.data...............................@....wixburn8...........................@..@.rsrc...T...........................@..@.reloc...=.......>..................@..B........................................................................................................................................................................................................................................................

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1028\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2025
Entropy (8bit):	6.231406644010833
Encrypted:	false
SSDEEP:	48:cxX7DTAT8tMBCus9T3FVWmHdniarRFeOrw8Nhv2VyfN3mKNWFP44SBWWW1GyfiPq:8L4T2RJhfHP8+VYuTmQUc2mE
MD5:	1D4B831F77EFEC96FFBC70BC4B59B8B5
SHA1:	1B3ED82655AEC8A52DAEC60F8674BC7E07F8CFEB
SHA-256:	1B93556F07C35AC0564D57E0743CCBA231950962C6506C8D4A74A31CD66FD04C
SHA-512:	C6CCB188281F161DEBF02DCDDE24B77D8D14943DEED8852E77E5AFB18F3F62683AB1AE06DCEB1E09D53804A76DF6400A360712D8E7E228B7F971054BB4FB2496
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="zh-tw" Language="1028" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName] ...... Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/passive \| /quiet - ...... UI ............ UI ... ........... UI ........../norestart - ................UI ............./log log.txt - ............ %TEMP% ......</String>.. <Stri

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1029\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2458
Entropy (8bit):	5.36165936198009
Encrypted:	false
SSDEEP:	48:cxX7DTZT8u9cktosM6re4mSTcIIyfI7sh/DMNwIHWAoN3mepNRfKPnWZ0hqAQZfC:8LxTK23f33AwIViRrRynRuZfiMS
MD5:	CC8C6D04DC707B38E0F0C08BA16FE49B
SHA1:	95EA7F570677AEA52393D02FDB21CEBB218A7343
SHA-256:	DC445E2457ED31ABF536871F90FF7CC96800A40B6BC033F37D45E3156A3B4FA9
SHA-512:	A4B19EBC8BB0D88ABA7D3D5783E28F8B6E0960582A540059BC71076B1203BF43BCA15EA726272D15395C7B4E431046ADA1CBB9D55072BBC5DBE7729C4599F0E0
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="cs-cz" Language="1029" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalace produktu [WixBundleName]</String>.. <String Id="Title">Pro instalaci produktu [WixBundleName] je vy.adov.no rozhran. Microsoft .NET Framework.</String>.. <String Id="ConfirmCancelMessage">Opravdu chcete akci zru.it?</String>.. <String Id="HelpHeader">N.pov.da k instalaci</String>.. <String Id="HelpText">/passive \| /quiet - Zobraz. minim.ln. u.ivatelsk. rozhran. bez jak.chkoli.. v.zev, nebo nezobraz. ..dn. u.ivatelsk. rozhran. ani ..dn. v.zvy. Ve v.choz.m.. nastaven. se jak u.ivatelsk. rozhran., tak i v.echny v.zvy zobrazuj....../norestart - Potla.. jak.koli p

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1030\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2286
Entropy (8bit):	5.061915970731254
Encrypted:	false
SSDEEP:	48:cxX7DCrT81tbzjamsjFq7LhzqGgdRDJNbqoN3mpN+ELPnfyOwYxPyzraXnAF:8LaTOkaEOiGd/BwF
MD5:	7C6E4CE87870B3B5E71D3EF4555500F8
SHA1:	E831E8978A48BEAFA04AAD52A564B7EADED4311D
SHA-256:	CAC263E0E90A4087446A290055257B1C39F17E11F065598CB2286DF4332C7696
SHA-512:	2A02415A3E5F073F4530FD87C97B685D95B8C0E1B15EFD185CC5CB046FCF1D0DCE28DB9889AD52588B96FE01841A7A61F6B7D6D2F669EAB10A8926C46B8E93D1
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="da-dk" Language="1030" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Installation af [WixBundleName]</String>.. <String Id="Title">Microsoft .NET Framework skal v.re installeret i forbindelse med Installationen af [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Er du sikker p., at du vil annullere?</String>.. <String Id="HelpHeader">Hj.lp til installation</String>.. <String Id="HelpText">/passive \| /quiet - viser en minimal brugergr.nseflade uden prompter eller.. viser ingen brugergr.nseflade og ingen prompter... Brugergr.nsefladen og alle prompter vises som standard...../norestart - skjuler fors.g p. genstart. Der vises som standard en.. foresp.rgse

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1031\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2442
Entropy (8bit):	5.094465051245675
Encrypted:	false
SSDEEP:	48:cxX7DASTcCwit/soJy9hkVByUZN+29N3mfN65PS9CvZwZi7uuASD:8LxT8itGeVB97+gyC9BdaSD
MD5:	C8E7E0B4E63B3076047B7F49C76D56E1
SHA1:	4E44E656A0D552B2FFD65911CB45245364E5DBF3
SHA-256:	631D46CB048FB6CF0B9A1362F8E5A1854C46E9525A0260C7841A04B2316C8295
SHA-512:	FD7E8896F9414F0DB7A88F926F55EE24E0591DA676F330200BC6BB829EB32648D90D3094E0011BFE36C7BA8BE41DFD74B12D444AFEA0D2866801258DA4FA16E8
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="de-de" Language="1031" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <UI Control="InstallButton" Width="180" />.. .. <String Id="Caption">[WixBundleName]-Setup</String>.. <String Id="Title">F.r das [WixBundleName]-Setup ist Microsoft .NET Framework erforderlich.</String>.. <String Id="ConfirmCancelMessage">Sind Sie sicher, dass Sie den Vorgang abbrechen m.chten?</String>.. <String Id="HelpHeader">Setup-Hilfe</String>.. <String Id="HelpText">/passive \| /quiet - zeigt eine minimale Benutzeroberfl.che ohne.. Eingabeaufforderungen oder keine Benutzeroberfl.che und keine.. Eingabeaufforderungen an. Standardm..ig werden die Benutzeroberfl.che und.. alle Eingabeaufforderungen angezeigt...../no

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1032\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3400
Entropy (8bit):	5.279888750092028
Encrypted:	false
SSDEEP:	48:cxX7D8jVT8dUk9Ug/usOo2pNSBIbESvR2drdESPzghC76DeN2hL0eLoN3mOLSNIx:8L45TCyop5riGzH7xgJit8IqSsBwqk
MD5:	074D5921AF07E6126049CB45814246ED
SHA1:	91D4BDDA8D2B703879CFE2C28550E0A46074FA57
SHA-256:	B8E90E20EDF110AAAAEA54FBC8533872831777BE5589E380CFDD17E1F93147B5
SHA-512:	28DAC36516BCC76BCC598C6E7ABDE359695F85AB7A830D6ADBC844EB240D9FA372CB5A5CE4DBE21E250408C6B246D371D3CDD656D2178FB0EC22DAC7D39CBD9F
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="el-gr" Language="1032" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">........... ... [WixBundleName]</String>.. <String Id="Title">... ... ........... ... [WixBundleName] .......... .. Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">..... ....... ... ...... .. ..... .......;</String>.. <String Id="HelpHeader">....... ... ... ...........</String>.. <String Id="HelpText">/passive \| /quiet - ......... ........ ........... ... ............. .......... ...... ..... ........ . ... ..

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1035\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2235
Entropy (8bit):	5.142592159444541
Encrypted:	false
SSDEEP:	48:cxX7DE+T8Z+bm5snwETMAoQEATN27uNBDReq4N3mJeNHNP64NsFKJJem4vyAs:8LZTDkZ7+2IBCht6J8neHs
MD5:	E338408F1101499EB22507A3451F7B06
SHA1:	83B42F9D7307265A108FC339D0460D36B66A8B94
SHA-256:	B7D9528F29761C82C3D926EFE5E0D5036A0E0D83EB4CCA7282846C86A9D6F9F3
SHA-512:	F7BE923DC2856E0941D0669E2DE5A5C307C98DC7EBA0A1B68728EB29C95B4625145C2AD3AC6F6B6D82F062887EA349E2187F1F91785DDE5A5083BC1150E56326
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="fi-fi" Language="1035" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] -asennus</String>.. <String Id="Title">Microsoft .NET Framework tarvitaan [WixBundleName] -asennusta varten</String>.. <String Id="ConfirmCancelMessage">Haluatko varmasti peruuttaa?</String>.. <String Id="HelpHeader">Asennusohjelman ohje</String>.. <String Id="HelpText">/passive \| /quiet - n.ytt.. mahdollisimman v.h.n k.ytt.liittym.st.; ei.. kehotteita tai ei k.ytt.liittym.. ja kehotteita. Oletusarvoisesti.. k.ytt.liittym. ja kaikki kehotteet n.ytet..n...../norestart - est.. uudelleenk.ynnistysyritykset. Oletusarvoisesti.. k.ytt.liittym. kysyy ennen uudelleenk.yn

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1036\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2306
Entropy (8bit):	5.076293283609686
Encrypted:	false
SSDEEP:	48:cxX7DyBT81BbKBswAL1xV1wjRcDSNwDXoN3mSZfNhkLPkQpznsdMEodAY:8LwTK5KHsijmEXY
MD5:	AA32A059AADD42431F7837CB1BE7257F
SHA1:	4CD21661E341080FB8C2DEFD9F32F134561FC3BA
SHA-256:	88E7DDACD6B714D94D5322876BD50051479B7A0C686DC2E9EB06B3B7A0BC06C9
SHA-512:	78E201F369E65535E25722DFC0EFE99EDF641F7C14EFF1526DC1CC047FF11640079F1E3D25C9072CF25F4804195891BE006FC5ED313063AFCB91FB5700120B88
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="fr-fr" Language="1036" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Installation de [WixBundleName]</String>.. <String Id="Title">Microsoft .NET Framework requis pour l'installation de [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.tes-vous s.r de vouloir annuler.?</String>.. <String Id="HelpHeader">Aide de l'installation</String>.. <String Id="HelpText">/passive \| /quiet - affiche une interface minimale sans invites ou n'affiche.. aucune interface ni aucune invite. Par d.faut, l'interface et toutes les.. invites sont affich.es...../norestart - annule toute tentative de red.marrage. Par d.faut, l'interface.. affiche une invite avant de red.marrer..

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1038\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2392
Entropy (8bit):	5.293225307744296
Encrypted:	false
SSDEEP:	48:cxX7DwzT8cSwvs48mF7GD/g1v0wH7N3wwJxL99oN3m/ZNRUYPBZRT1XESW3o/ULG:8LQT2wpFGbgT3wMN2QRj/y/LKr
MD5:	17FB605A2F02DA203DF06F714D1CC6DE
SHA1:	3A71D13D4CCA06116B111625C90DD1C451EA9228
SHA-256:	55CF62D54EFB79801A9D94B24B3C9BA221C2465417A068950D40A67C52BA66EF
SHA-512:	D05008D37143A1CC031F4B6268490A5A10FBB686C86984D20DB94843BDC4624EF9651D158DCB5B660FC239C3C3E8D087EB5D23FFFB8C4681910CBC376148F0F0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="hu-hu" Language="1038" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] telep.t.</String>.. <String Id="Title">A(z) [WixBundleName] telep.t.s.hez Microsoft .NET-keretrendszer sz.ks.ges</String>.. <String Id="ConfirmCancelMessage">Biztosan megszak.tja?</String>.. <String Id="HelpHeader">A telep.t. s.g.ja</String>.. <String Id="HelpText">/passive \| /quiet - Minim.lis felhaszn.l.i fel.let megjelen.t.se k.rd.sek.. n.lk.l, illetve felhaszn.l.i fel.let .s k.rd.sek megjelen.t.se n.lk.li.. telep.t.s. Alapesetben a felhaszn.l.i fel.let .s minden k.rd.s megjelenik...../norestart - Az .jraind.t.si k.r.sek elrejt.se. Alapeset

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1040\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2304
Entropy (8bit):	4.985260685429469
Encrypted:	false
SSDEEP:	48:cxX7DQyT81ebRcesyB+lY25ukVpkXJM2DJNXhpXZoN3mMhNTM+POYO/n1YxXlcI5:8LFTzLtkfwWKXHZi37MIDp
MD5:	50261379B89457B1980FF19CFABE6A08
SHA1:	F80B1F416539D33206CE3C24BA3B14B799A84813
SHA-256:	A40C94EB33F8841C79E9F6958433AFFD517F97B4570F731666AF572E63178BB7
SHA-512:	BBD9794181EEC95D6BE7A1B7BA83FD61AF2B2DF61D9DA8DDA2788B61BEC53C30FCEFE5222EDF134166532B36D3AB6CE8996F2D670DC6907C1864AF881A21EA40
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="it-it" Language="1040" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Installazione di [WixBundleName]</String>.. <String Id="Title">Microsoft .NET Framework necessario per l'installazione di [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Annullare?</String>.. <String Id="HelpHeader">Guida dell'installazione</String>.. <String Id="HelpText">/passive \| /quiet - visualizza l'interfaccia utente minima senza istruzioni.. oppure non visualizza n. l'interfaccia utente n. le istruzioni. Per.. impostazione predefinita vengono visualizzate interfaccia utente e.. istruzioni...../norestart - elimina eventuali tentativi di riavvio. Per impostazione.. predefinita l'int

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1041\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2545
Entropy (8bit):	5.923292576429967
Encrypted:	false
SSDEEP:	48:cxX7DpcYT86WyscLpTIFw6tnOUjsj/D3NIgHcQN3mKN/WPOhT0SXsDay+z8QZEcE:8L1TccOFw6tnOUjsjpICnlOO934apWz
MD5:	DB0F5BAB42403FD67C0A18E35E6880EC
SHA1:	C0A18C8C5BCD7B88C384B5304B56EEB85A0DA3DC
SHA-256:	CCDCDB111EFA152C5F9FF4930033698B843390A549699AE802098D87431F16FE
SHA-512:	589522BD4A26BF54CCF3564E392E41BBBA4E7B3FD1ED74E7F4F6AD6F2E65CDE11FFF32D0C5F3BCD09052FE5110FDC361D1926E220FD0BAD2D38CAC21BBE93211
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="ja-jp" Language="1041" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ......</String>.. <String Id="Title">[WixBundleName] ........ Microsoft .NET Framework .....</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">..........</String>.. <String Id="HelpText">/passive \| /quiet - ... UI ....................UI.. .............. .....UI ....................../norestart - ........................

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1042\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2236
Entropy (8bit):	5.97627825234954
Encrypted:	false
SSDEEP:	48:cxX7D3sT8ZeusKOwOWGyKCstFmhENI2Y+kN3mp4iNmi6IPa0dDaoIunvZqIHU5UH:8LQTXvRFhIzl44wmgko04U5TY
MD5:	442F8463EF5CA42B99B2EFACA696BD01
SHA1:	67496DB91CBAA85AC0727B12FC2D35E990537DAC
SHA-256:	D22F6ADA97DBFFC1E7548E52163807F982B30B11A2A5109E71F42985102CCCBD
SHA-512:	A350EAF9E7AEAFAB1163D7C0B8D014AFE07EE98BAE3915CBDD3C26282E345A0838E853C89BAE8943474758DCBCFD0BB0724A0C75CBF969F321FAB4944E8704FD
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="ko-kr" Language="1042" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ..</String>.. <String Id="Title">[WixBundleName] ... ... Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">.. ...</String>.. <String Id="HelpText">/passive \| /quiet - ... .. .. UI. ..... UI. .... .... .... ..... ..... UI . .. .... ........../norestart - .. ..... ... ...... ..... UI. .. .... .. .... ......../log log.txt - .

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1043\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	4.965432037520827
Encrypted:	false
SSDEEP:	48:cxX7DK1T8u7hbU7Asd7MqpSwzCcHGFN9OsNN3mvoNBC7hPFtO7+xw7t0Yza2Al:8LcTtpGLFSwJHmPnnKhEBtsl
MD5:	67F28BCDB3BA6774CD66AA198B06FF38
SHA1:	85D843B7248A5E1173FF9BD59CB73BB505F69B66
SHA-256:	226B778604236931B4AE45F6F272586C884A11517444A34BF45CD5CAE49BE62E
SHA-512:	7BC7D3E6E19ECF865B2CABFC46C75D516561D5A8A81A8ED55B4EDBA41A13A7110F474473740200AFB035B9597A2511D08C2A2E7A9ADE2C2AB4D3F168944B8328
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="nl-nl" Language="1043" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Installatie</String>.. <String Id="Title">Microsoft .NET Framework is vereist voor installatie [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Weet u zeker dat u de installatie wilt annuleren?</String>.. <String Id="HelpHeader">Help bij Setup</String>.. <String Id="HelpText">/passive \| /quiet - geeft een minimale gebruikersinterface weer zonder prompts.. of geeft geen gebruikersinterface en geen prompts weer. Gebruikersinterface.. en alle prompts worden standaard weergegeven...../norestart - pogingen tot opnieuw opstarten onderdrukken... Gebruikersinterface vraagt standaard al

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1044\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2171
Entropy (8bit):	5.089922193759582
Encrypted:	false
SSDEEP:	48:cxX7DTeT8uUbnFdsLnFHv+Gpm1qL5DQNDDaoN3mpZfN15dPnfuOOg5wZ5uAq8fAS:8L+Tec1x8Siule4S
MD5:	5454F724C9CDAB8172678A1CC7057220
SHA1:	241A57018ACE1210881583A9CF646E7D2E51412F
SHA-256:	41545AC1247B61C3C3E2A7E4659D9FAD2BCCA8347C69F2EB7B9D0CF5FC31E113
SHA-512:	40E311EADA299996E32A7D35223CA678A03C869D63C023D59BC97A7B2049B0252AA9D0A7EC8558D5ACB73BD14C7BFA913097E65ABEE7455658DB7E35BBDA8AE1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="nb-no" Language="1044" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Installasjonsprogram</String>.. <String Id="Title">Microsoft .NET Framework kreves for [WixBundleName]-installasjon</String>.. <String Id="ConfirmCancelMessage">Er du sikker p. at du vil avbryte?</String>.. <String Id="HelpHeader">Installasjonshjelp</String>.. <String Id="HelpText">/passive \| /quiet - viser minimalt brukergrensesnitt uten ledetekster, eller.. ikke noe brukergrensesnitt og ingen ledetekster. Som standard vises.. brukergrensesnitt og alle ledetekster...../norestart - undertrykker alle fors.k p. omstart. Som standard sp.r.. brukergrensesnittet f.r omstart.../log log.txt

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1045\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2368
Entropy (8bit):	5.270514043715206
Encrypted:	false
SSDEEP:	48:cxX7Du4OT82gXusarwkfpYrKD8DTNkbNuoN3mjbsNniIPh8ynN1NYd4iYuffAL:8LKTsXgpYr2IyoiiOffpT3L
MD5:	96ACAAA5AEF7798E9048BAFF4C3FA8D3
SHA1:	E76629973F6C1CFC06F60BA64FE9F237B2DB9698
SHA-256:	F4AA983E39FB29C95E3306082F034B3A43E1D26489C997B8E6697B6A3B2F9F3C
SHA-512:	964F73E572BDCB1AD946C770E6A2FB4A1CE54AF4B5BB072F64256083BA27A223F4DAD4A95B9D2A646180806D1F977726147970B06AAC35EED75AEC6CA89ED337
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="pl-pl" Language="1045" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalator programu [WixBundleName]</String>.. <String Id="Title">Do zainstalowania programu [WixBundleName] jest wymagany program Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">Czy na pewno chcesz anulowa.?</String>.. <String Id="HelpHeader">Pomoc instalatora</String>.. <String Id="HelpText">/passive \| /quiet - wy.wietla minimalny interfejs u.ytkownika bez monit.w.. lub nie wy.wietla interfejsu u.ytkownika ani monit.w. Domy.lnie jest.. wy.wietlany interfejs u.ytkownika i wszystkie monity...../norestart - pomija wszelkie pr.by ponownego uruchomienia. Domy.lnie.. interf

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1046\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2147
Entropy (8bit):	5.130635342194656
Encrypted:	false
SSDEEP:	48:cxX7DuoT85b0s/4TDoYDj4NF5j2hN3mMNYskPDXKIMaKcP9A5g:8L1TmBHjs59M8r6
MD5:	BD39ADB6B872163FD2D570028E9F3213
SHA1:	688B8A109688D3EA483548F29DE2E57A8A56C868
SHA-256:	ECB5C22E6C2423CAF07AEBE69F4FAF22450164EEE9587B64EF45A2D7F658CA15
SHA-512:	F2826BE203E767D09FF0D7677E1CF5B13113B773D529166DAE02A1F5DB2DC58E0856A34901DF70011EBABB6E964FAB7ACF38590E650BD629D4E4DC4CB36C8D45
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="pt-br" Language="1046" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Instala..o</String>.. <String Id="Title">Microsoft .NET Framework . necess.rio para instala..o do [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Tem certeza de que deseja cancelar?</String>.. <String Id="HelpHeader">Ajuda da Instala..o</String>.. <String Id="HelpText">/passive \| /quiet - exibe UI m.nima sem avisos ou exibe sem UI e.. sem avisos. Por padr.o a UI e todos avisos s.o exibidos...../norestart - suprime qualquer tentativa de reinicializa..o. Por padr.o a UI.. ir. solicitar antes de reiniciar.../log log.txt - logs para um arquivo espec.fico. Por padr.

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1049\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2880
Entropy (8bit):	5.408094213063887
Encrypted:	false
SSDEEP:	48:cxX7DkTT8fjtEeusogrohY2Ar7DHNnjTh53oN3miRMNKrdPin+/uYcbSkuEIcOvG:8LYT8EeHMMJRNi1Ruwi3OwL
MD5:	DAF167AF4031EF47E562056A7D51AA73
SHA1:	0156B230CADD6169AC2820865E3C031ED79785EF
SHA-256:	C91C9E87AB4A6DB078F1991F4A2CDC726B58A40E47BCE49D39168A8F8F151C3B
SHA-512:	5E87EE3838E3595ADBD7EABA6E3E33CDFEA5E15ED716FBCCDBD55235B3E53E1E41EA5A907F425E96C35167543C7F75AC5214B5AEE177D299FC2464A68B22851E
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="ru-ru" Language="1049" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">......... [WixBundleName]</String>.. <String Id="Title">... ......... [WixBundleName] ......... Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">.. ............. ...... ........ ........?</String>.. <String Id="HelpHeader">....... .. .........</String>.. <String Id="HelpText">/passive \| /quiet - ........... ............ .. ... ........ ... ...... ... .. .. . ............ .. ......... ............ .. . ... ......

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1051\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2334
Entropy (8bit):	5.397882326481071
Encrypted:	false
SSDEEP:	48:cxX7D+cT8muPusz2qs1u+Vh1TqDINHZJoN3m8fN0vPp3OAwa2ywSODAm:8L1TuPdKNzfifFmcatm
MD5:	016C278E515F87F589AD22C856B201F7
SHA1:	F20C7DB38B3161B143DEC4E578CE71D7F585F436
SHA-256:	4A7FDF4A9033FE05C31F565ED3AE5B8C67D324B7AEADB737CE95DBB416D46868
SHA-512:	310C85B27E1ECF4C6729E88051037150CFBA0234A0138666C26662B3D665FF38B74E95ABCADDEEF6CBEBB23E3357FAC487E6EE5EB8FE158C269D77672191B042
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="sk-sk" Language="1051" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] . in.tal.cia</String>.. <String Id="Title">Na in.tal.ciu aplik.cie [WixBundleName] sa vy.aduje s..as. Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">Naozaj chcete zru.i. oper.ciu?</String>.. <String Id="HelpHeader">Pomocn.k pre in.tal.ciu</String>.. <String Id="HelpText">/passive \| /quiet . zobraz. minim.lne pou..vate.sk. rozhranie bez v.ziev alebo.. nezobraz. .iadne pou..vate.sk. rozhranie ani v.zvy. Predvolene sa.. zobrazuje pou..vate.sk. rozhranie aj v.etky v.zvy...../norestart . zru.. v.etky pokusy o re.tart. Pou..vate

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1053\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2132
Entropy (8bit):	5.1255014007111495
Encrypted:	false
SSDEEP:	48:cxX7DviT8NFLbu9sM2vECjf26axBZYXcqADCNKTbkoN3maT6NWOjEXPauOOKYnhf:8LmTAcRnQXFPK0iHMsfb2Ws3M
MD5:	D95E81164C57B6FD75E7C3022454192E
SHA1:	5D5ACBC56E7078AF4D04C45B78C0FF090C02EE6A
SHA-256:	6DD61CC6B87B53EAF28430068A2A459730FD4B2BCF876CCDF040212D04C4FE7D
SHA-512:	9E4BA81A145574818DD6A1F1D0EC38EA1629C7771919C35923F440E31EA9912E1630D94FCDB82B71104EBD61D0321DCDF935BA20D69988EE6E9B22259186AF0C
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="sv-se" Language="1053" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName]-installation</String>.. <String Id="Title">Microsoft .NET Framework kr.vs f.r installation av [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Vill du avbryta?</String>.. <String Id="HelpHeader">Installationshj.lp</String>.. <String Id="HelpText">/passive \| /quiet - visar ett minimalt anv.ndargr.nssnitt utan prompter,.. alternativt inget anv.ndargr.nssnitt och inga prompter. Som standard visas.. anv.ndargr.nssnitt och samtliga prompter...../norestart - hejdar omstart. Som standard visar anv.ndargr.nssnittet en.. prompt f.re omstart.../log log.txt - skapar logg till

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1055\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2303
Entropy (8bit):	5.2754753523795275
Encrypted:	false
SSDEEP:	48:cxX7DNcYT8anOSMsHEqGpcBztpvrJlrs2ZmNI2+Yo6irN3m22NFcPc+4Trzrdgc7:8LZHTE7APaTI9sq6yEbgg
MD5:	01B200E06BA600A4EF00C00F7AAC5CE4
SHA1:	22234426C42637E069A46217019551E4434A4AB6
SHA-256:	06BFB6DFBC38105C699DEA226A029DF3EF673C33E4B8928DC4EC7FB8F761487D
SHA-512:	8BDCF7533A6BCFA231B42A7EF845A70C7535FBF607D62FF6404928D5941BA6AFBF139450A1A1B58C65FACF88DC0785AEC4ABEFBCC803466A58B1930F7C468CDD
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="tr-tr" Language="1055" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Kurulumu</String>.. <String Id="Title">[WixBundleName] kurulumu i.in Microsoft .NET Framework gerekir</String>.. <String Id="ConfirmCancelMessage">.ptal etmek istedi.inizden emin misiniz?</String>.. <String Id="HelpHeader">Kurulum Yard.m.</String>.. <String Id="HelpText">/passive \| /quiet - komut istemi olmayan olabildi.ince k...k bir UI.. g.r.nt.ler veya komut istemi ve UI g.r.nt.lemez. Varsay.lan olarak UI.. ve t.m komut istemleri g.r.nt.lenir...../norestart - yeniden ba.latma denemelerini engeller. Varsay.lan.. olarak UI yeniden ba.latmadan .nce komut isteyecekt

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1060\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2200
Entropy (8bit):	5.1485120966265
Encrypted:	false
SSDEEP:	48:cxX7DZ0T8obZsw9g5gS56K97D7NCt2VoN3mQXNJPOhP58vqc1qwueo3RAL:8LyTLlS9h9hCtsihdxOh+NL
MD5:	5836F0C655BDD97093F68AAF69AB2BAB
SHA1:	B6842E816F9E0DCC559A5692E4D26101D10B4B16
SHA-256:	C015247D022BDC108B4FFCAE89CB55D1E313034D7E6EED18744C1BB55F108F8C
SHA-512:	640A79D6A756E591AD02DDCCC53BC43F855C5148B8CBB5CE6C1CAF5419CA02F7B2AFF89CCA4C056356814D3899EF79BF038B4E8B4B79EB85138A3CEDCCE93E5B
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="sl-si" Language="1060" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Namestitev</String>.. <String Id="Title">Microsoft .NET Framework, potreben za namestitev paketa [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Ali ste prepri.ani, da .elite preklicati?</String>.. <String Id="HelpHeader">Pomo. za namestitev</String>.. <String Id="HelpText">/passive \| /quiet - prika.e minimalni uporabni.ki vmesnik brez pozivov ali ne prika.e.. uporabni.kega vmesnika in pozivov. Privzeto so prikazani uporabni.ki vmesnik in.. vsi pozivi...../norestart - skrije vse mo.nosti za vnovicni zagon. Privzeto uporabni.ki vmesnik.. prika.e poziv pred ponovnim zag

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\2052\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1980
Entropy (8bit):	6.189594519053644
Encrypted:	false
SSDEEP:	48:cxX7DjQT8tOBousi+zq+frUR2ropNV2rfN3msNUqPPT9T+DwZ9f5wDTAV:8L4TGUGw3V8N3RykV
MD5:	A34DCF7771198C779648B89156483E83
SHA1:	A6E0FA91CD50048511C7BEF1BE3A8D32B42B6D1F
SHA-256:	89C559C6765F8D643469E3C8F4AA93023F09369B0395EA647FAD5AF3C2893EB6
SHA-512:	0F1D7BC4FD64E18EEEC488CDCE01FB6BFA5CD3BFF614A8D03E388D39F569B8341E74302946877EB25BA1EB17AEC137499189605E251FAFB6B20051744CB463B1
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="zh-ch" Language="2052" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] ..</String>.. <String Id="Title">[WixBundleName] .... Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/passive \| /quiet - ..... UI .......... UI ... ........... UI ........../norestart - .............. UI ........../log log.txt - .............. %TEMP% ........</String>.. <String Id="HelpCloseButton"

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\2070\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2211
Entropy (8bit):	5.1155097909395035
Encrypted:	false
SSDEEP:	48:cxX7DbT8QGls54nK3znI5zKDj4NLkdoN3mMNYsEPbpK2Aegeu9A5g:8LXTUasJnYdi59som6
MD5:	8A278E519EF81B2847490EFB070219BC
SHA1:	7365EDF6E4F9E66B6CEE47933B6C70FF0B9ECFF8
SHA-256:	E2BFDB2CF3BEAE2E988827C52C58006D7EEAD4ABA5312B5EAE1F6CCF3863C385
SHA-512:	88275C1136FFB15AB04D315E8601BE2DE77387F3E00F17E9807E415A9DFC4A73E2CD3B5710E4CA58006F91E18180D7CFAEEF4E8319C624E1B81397F9CB9ECA92
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="pt-pt" Language="2070" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Configura..o do [WixBundleName]</String>.. <String Id="Title">O Microsoft .NET Framework . necess.rio para a configura..o do [WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Tem a certeza de que pretende cancelar?</String>.. <String Id="HelpHeader">Ajuda da Configura..o</String>.. <String Id="HelpText">/passive \| /quiet - apresenta IU m.nima sem mensagens ou n.o apresenta IU nem.. mensagens. Por predefini..o, s.o apresentadas a IU e todas as mensagens...../norestart - suprimir qualquer tentativa de rein.cio. Por predefini..o, a IU.. avisar. antes de reiniciar.../log log.txt - r

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\3082\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2400
Entropy (8bit):	4.992567587099768
Encrypted:	false
SSDEEP:	48:cxX7DLT8/OusS2V8j4Lq+7dKzCLdqaaD6NJaXFoN3mRNLo3PWKWnRcsB9A8:8LfTz+8EPqKqTJiFikUgk8
MD5:	1024AA88AE01BC7BA797193CC6023375
SHA1:	9252A309C1CB32573F4D58A595A78660FDF54B2F
SHA-256:	B884C4ABB8867553C1FFADD6721C2135EC5F9F1455C3F668D711CCEA65363D1A
SHA-512:	77E6DD332104C0461B7C5A08469161AF3F1DC51D3B55585D39DD9FC9E2088DA036BDF2278CFB96CA702FD26CE073C6C6F66611313270700B9E7A76600C1C8E38
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="es-es" Language="3082" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">Instalaci.n de [WixBundleName]</String>.. <String Id="Title">La instalaci.n de [WixBundleName] requiere Microsoft .NET Framework</String>.. <String Id="ConfirmCancelMessage">.Est. seguro de que desea cancelar?</String>.. <String Id="HelpHeader">Ayuda del programa de instalaci.n</String>.. <String Id="HelpText">/passive \| /quiet - muestra una interfaz de usuario m.nima y no realiza.. preguntas, o bien no muestra interfaz de usuario y no realiza preguntas... De manera predeterminada se muestra la interfaz de usuario completa y se.. realizan todas las preguntas necesarias...../norestart - suprime cu

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.CrashReporter.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	482008
Entropy (8bit):	6.154539553472361
Encrypted:	false
SSDEEP:	6144:O6hpAmAT0xSL19fr+UAKADJUXXz9ud0MaWf2MlN:OV0xSZ9aUGDSXXkd0MaNQN
MD5:	10E3C696E190B04B2E232132D2630488
SHA1:	B8A83041099DB3582448DDE683EA28CCEE4687B3
SHA-256:	9F31B46829ED7522905E179438A90CE59E514D1932A15265777AB1A48F9BCE1F
SHA-512:	485C483BEB0DA1B3331D2C7685EC52075172AA4212684927B35F84289970BD8C7888BCD352B0F244A6B27EA5E62D57A865F4196362C2434277BB113D5C41886E
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.CrashReporter.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....P.............!..0..&...........E... ...`....@.. ....................................`.................................PE..K....`...................,...........D............................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@....reloc...............,..............@..B.................E......H............................H..}D......................................"+.(n..6...B(....(....(.......:+.(7A\n.(.....:+.(.I.K.(............................8.....(.... ....~Y...{q...9....& ....8....8........E........8.............................8.....(.... ....~Y...{=...:....& ....8....8........E....(...........'...8#.....(.... ....8......(.... ....8......(.... ....~Y...{....9....& ....8......"........................................8........E............8......}.

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.Base.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	855768
Entropy (8bit):	6.222493767105795
Encrypted:	false
SSDEEP:	12288:NOmGkoCPAtu1FLc7/B7uX3VVgp9fAOcSoGV:NTgtALc7p7uX3VFOf5V
MD5:	06D7E3ABC6B28FC38FE893C9F8F21036
SHA1:	3D0D57203DC89762C5B5893B4C2F1A45910E791A
SHA-256:	492855C94E281C379F70436AC00E222D86EE3BF4E5A0963864446703C0F916C7
SHA-512:	E68EF3ACDE2B7B5DDA9212144D0FCF0931D6EB89B820838E0D785699D38BD006CF4D7B541E67FA7B26D0FB2E0234AFD27F67E9C2910EF7806624BAF74CA0D46A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.Base.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....we...........!..0.................. ........@.. .......................@......;-....`.....................................K........................,... ......T................................................ ............... ..H............text........ ...................... ..`.rsrc...............................@....reloc....... ......................@..B........................H........~..t...........4...U..........................................."+.(s:ET...B(@...(....(.......:+.(...5.(6....:+.(.wIS.(......(@...(6..........................8.....(.... ....~....{....:....& ....8....8........E................8......}.... ....8......}.... ....~....{....9....& ....8...............{.............{................................8........E....................S...~...o...........8...........s....Q ....8.... Z.)f KHP.a~....{....a(..........%.

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.Installer.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	55000
Entropy (8bit):	6.04745520316539
Encrypted:	false
SSDEEP:	768:21yhqMcCFPZFxnvwjrBBJDiooowIoooooSToooooooooooooooooooooooooooEH:yyhXc21MVBTWMVEd0QDPZX4kXgM8wjxK
MD5:	663B231820345A3CA7BAA44D961026DD
SHA1:	44259C9E4C8C912F4811BAE485C7F072EEF60B02
SHA-256:	33DBAAA5DC48A291F79DDF5CF31B18BB7103CB0118CBFE0B1345A9CDC96A5966
SHA-512:	A1AE2CF32BAE722A85A185D2F137805CCDB515C796800CDF2983BD3642A77DE19375876A04862E5299269D9473040D9C6359268F17F0934DFA497FAC413C467A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....]............" ..0.................. ........... ..............................L(....`.....................................O........................,.............8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......XB...y..................L.........................................{...."..}....2. `...(....:.(......(........0............(......,...(....o.........0..w........(....,....i.r...po....,8.r...p.o.........Yo....(.....r...p......%...L....(....+..(..........r;..p......%...(..................\\......:.( .....(......{...."..}.....r...p......%...%...(.....(....o!...o".....o#.......0..P.......r...p......%...(.....(....o!...o"....o$.....!.r...p......%...%...(....~%....

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.UI.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	639192
Entropy (8bit):	6.058189565817626
Encrypted:	false
SSDEEP:	6144:LGEBnd/tYXGXHdXq64BbV4ubA35cg/glGPt+Awe3+IOdWwtpIqkHhpAOY3cmlIlx:uv03v/glGt+A6ddWwfuAOY3cVp5h
MD5:	07623A8708530A79689D8E097BB8241C
SHA1:	6BFC3F7C5F51E49F0C447CBF8BBBDE192FFE81F0
SHA-256:	68BD88D1B8E0236F273158ACF27BF2F338DF5B1EAF5343E19DA25302A22B3A58
SHA-512:	5B8528F5370DDBBE65B1DA3D4277784B78D2A4CC4CDF6FA5290D87D8CA84F5E65B84DA39C3DC00FFA6C35C6EC085963B863FDB47DAACDD0F46F99A52457B0496
Malicious:	true
Yara Hits:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.UI.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..../-e...........!..0.................. ........@.. ....................................`....................................K........................,........................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@....reloc..............................@..B........................H...........4...............9..........................................."+.(..(A...B(e...(....(.......:+.(=.ug.([....:+.(@.$I.(.............{................................8........E....+...,.......8&.....}.... ....~m...{`...9....& ....8..... .@. ..5.a~m...{....a(....~....(.... ....~m...{+...9....& ....8~...............................8........E....X.......8S... ... ...a~m...{ ...a(_.........%..(.....~....(.... ....~m...{-...9....& ....8.........*...............

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1786072
Entropy (8bit):	6.189657018493491
Encrypted:	false
SSDEEP:	24576:UmWBn+M+smp1d2ERryHdtXVtATSVUm2/WJ1jy4PIz7uSEWMPTtGyd73Qd:lM+xR+XVtAT6YWJ0kPWqtGytA
MD5:	60E5541CF9A9B781EA8597B72DE60341
SHA1:	FBF8D35735967F4724865ED5CD06F8D6803D9276
SHA-256:	7FA7B522DDC01FC97596AD4614A9CA3BF880426248DF795773347642119CFB15
SHA-512:	13AC4000A77C63D24AC1174386F460587439B8779220C5C3BCB60CBAAA643FD05DE0D52FB349EDE6AC8EA182DD755E3B6D9BAEC622366120141C28328EFE7F3A
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.dll, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuard.Utils.dll, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...%np............!..0..............)... ...@....@.. ...............................p....`.................................`)..K....@..t................,...`.......)............................................... ............... ..H............text........ ...................... ..`.rsrc...t....@......................@....reloc.......`......................@..B.................)......H.......\|...D............@.......(......................................"+.(..1N...B(0...(....(.......:+.(L.lc.(&............{.............{.........................}......}.................................8........E............,...R.......d...8.....u...... ....~P...{n...:....& ....8......:q... ....~P...{/...9....& ....8.......;H... ....8....87... ....~P...{$...:f...& ....8[...(.....{......{....o......*(.....{......{....o....9.... ....~P...{3...:....& ....8.......

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuardVpn.Burn.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	245248
Entropy (8bit):	5.183878159953743
Encrypted:	false
SSDEEP:	3072:3kwgs9A9oeRmInp3cKl7zU+NnPpYeNOf:3Dgs9Aamp3hl7zUQnPphN
MD5:	FF446A154477B4B557B840A81A6D5A9D
SHA1:	EF34932D3922BCE82352A27B13CCCA532BAFD520
SHA-256:	5703377F93A8FC49DDE924C591443E991889D39BF81EBC212E0C49A8BE2F9196
SHA-512:	8191F953C1918E0458C77C8054B9D0329746A7442692986F0CB4A4CFEF4C42B655EB530F9DCCC6C438A70C851AD0E8AB7865DE773CA178AECB3017F0D04D74F8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...EoF..........." ..0.................. ........... ....................... ............`.................................4...O...................................\...8............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................h.......H........R..............t...............................................>. 4......(....2......o....:........o.....0..,........o....r...p $...........%...%....o....t....&...o......(.....~............~.....r!..pV(....o....rC..po.....rK..p.(+....(,....r...p.r...p.r#..p.(0....(........0..\.......rq..p......( ...(!....("...-..-.r...p(.......(#...&r...p......%...P....( ....,..(.....($....0..........r1..p......( ...r...prg..p~%...(...+..('...,.r}..p......( ...*(.

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\AdGuardVpn.Burn.dll.config

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-8 (with BOM) text
Category:	dropped
Size (bytes):	656
Entropy (8bit):	4.964696021977938
Encrypted:	false
SSDEEP:	12:MMHdn9nF3F7yA5v5OXrSl2/uo+/toA5ceeycl2/kr/tOixj:JdnxNF7yYhOXrSl2/uo+/toYJUl2/krj
MD5:	F3B06257FAE705165146B020D3053745
SHA1:	2EC73BF60269CDCCE621B44297B7EDCD126EB4D4
SHA-256:	B005A38601A8027DC44688FF52C52E98DB2FD49721CBF3A1876828CF8350E2CB
SHA-512:	9660BAD0671B0EA7B02524A68C9382FA3CC7DBF54BCC63822DFCEC7BA47B2393E5207126023FA7979ACB084358819C93BBCD4087CA00ABAFA44353E785DE5A74
Malicious:	false
Preview:	.<?xml version="1.0" encoding="utf-8"?>.<configuration>. <runtime>. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">. <dependentAssembly>. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />. <bindingRedirect oldVersion="0.0.0.0-11.0.0.0" newVersion="11.0.0.0" />. </dependentAssembly>. <dependentAssembly>. <assemblyIdentity name="AdGuard.Utils" publicKeyToken="cc321ba03e90d705" culture="neutral" />. <bindingRedirect oldVersion="0.0.0.0-2.4.0.0" newVersion="2.4.0.0" />. </dependentAssembly>. </assemblyBinding>. </runtime>.</configuration>.

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\BootstrapperApplicationData.xml

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (450), with CRLF line terminators
Category:	dropped
Size (bytes):	5790
Entropy (8bit):	3.7901967640580705
Encrypted:	false
SSDEEP:	96:Xkdn6d0dUIychfn6JWaFU0yc5n68ax0woyciwUk4ve8XrgsNt:XSOnYfaeuvRI+/gbf
MD5:	1D9C598287BEDE5EFF9F4EFB20CC4887
SHA1:	DCAC52493820D6937E0D5627BC1F5D68F2F75971
SHA-256:	ACBE06FDF9E5FAC77A6A1C4CE13E79CE990293A759D19BFE3445899983177483
SHA-512:	D00BE0020399D7949DD796FBDA01BBBD4077AB57A11835CA88EFA726960656C9C00A40C02327D64C55D43055AE1700999BE91CE5849DEEFCDCD30B0BB5C66315
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.W.i.x.B.u.n.d.l.e.P.r.o.p.e.r.t.i.e.s. .D.i.s.p.l.a.y.N.a.m.e.=.".A.d.G.u.a.r.d.V.P.N.". .L.o.g.P.a.t.h.V.a.r.i.a.b.l.e.=.".W.i.x.B.u.n.d.l.e.L.o.g.". .C.o.m.p.r.e.s.s.e.d.=.".n.o.". .I.d.=.".{.8.1.d.1.5.6.6.6.-.1.3.4.9.-.4.a.b.6.-.b.a.b.e.-.4.d.5.f.b.1.9.c.1.9.f.9.}.". .U.p.g.r.a.d.e.C.o.d.e.=.".{.E.C.8.B.6.D.7.6.-.8.E.5.1.-.4.B.E.B.-.9.6.0.2.-.7.1.8.B.E.7.8.E.B.0.5.8.}.". .P.e.r.M.a.c.h.i.n.e.=.".y.e.s.". ./.>..... . .<.W.i.x.M.b.a.P.r.e.r.e.q.I.n.f.o.r.m.a.t.i.o.n. .P.a.c.k.a.g.e.I.d.=.".N.e.t.F.x.4.5.R.e.d.i.s.t.". .L.i.c.e.n.s.e.U.r.l.=.".h.t.t.p.:././.g.o...m.i.c.r.o.s.o.f.t...c.o.m./.f.w.l.i.n.k./.?.L.i.n.k.I.D.=.2.6.0.8.6.7.". ./.>..... . .<.W.i.x.P.a.c.k.a.g.e.P.r.o.p.e.r.t.i.e.s. .

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\BootstrapperCore.config

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	5.014979412561275
Encrypted:	false
SSDEEP:	24:2dRt7RtYr49itYQsKmhDrdHDxshqRQNF7yYhOXrSl2/uo+/tO2:cfRt0Kit0vlrh5QD7e71uo47
MD5:	427918825375CE8AA01F208629C901FA
SHA1:	BB983D3B30454DEB48695E495B8483195D72C927
SHA-256:	EEE85D8D43E427F87E043F9516BC2511C891980A134EBA7E2D6097438EF860E4
SHA-512:	1368FB726B21D96278773E37FF36B20952578C814F7E4D3EF76CC81A5B2D608F04E65C1E6328F19AA59F40DD2701D6F5AFA167CDE14143D385CD075A8359B4CF
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8" ?>.<configuration>. <configSections>. <sectionGroup name="wix.bootstrapper" type="Microsoft.Tools.WindowsInstallerXml.Bootstrapper.BootstrapperSectionGroup, BootstrapperCore">. <section name="host" type="Microsoft.Tools.WindowsInstallerXml.Bootstrapper.HostSection, BootstrapperCore" />. </sectionGroup>. </configSections>. <startup useLegacyV2RuntimeActivationPolicy="true">. <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />. </startup>. <wix.bootstrapper>. <host assemblyName="AdGuardVpn.Burn">. <supportedFramework version="v4\Full" />. <supportedFramework version="v4\Client" />. </host>. </wix.bootstrapper>. <runtime>. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">. <dependentAssembly>. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral" />. <bindingRedirect oldVersion="0.0.0.0-11.0.0.0" newVersion="11.0.0.0" />. </d

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\BootstrapperCore.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	90032
Entropy (8bit):	5.688550211341784
Encrypted:	false
SSDEEP:	768:9BgPxZlx0MBps+j7ejaab0Y6OwE7v10WHSp5fh06iG27N9k+6ybJ1ErEgtCmYjhm:HHMBp/GRbgi5ofpiG2pq+51EogsmYI
MD5:	B0D10A2A622A322788780E7A3CBB85F3
SHA1:	04D90B16FA7B47A545C1133D5C0CA9E490F54633
SHA-256:	F2C2B3CE2DF70A3206F3111391FFC7B791B32505FA97AEF22C0C2DBF6F3B0426
SHA-512:	62B0AA09234067E67969C5F785736D92CD7907F1F680A07F6B44A1CAF43BFEB2DF96F29034016F3345C4580C6C9BC1B04BEA932D06E53621DA4FCF7B8C0A489F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Mp.].........." ..0...... ........... ...@....... ..............................N.....@.................................`...O....@...............@.......`......(-............................................... ............... ..H............text........ ...................... ..`.rsrc........@....... ..............@..@.reloc.......`.......0..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\Newtonsoft.Json.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	662528
Entropy (8bit):	5.91790849905593
Encrypted:	false
SSDEEP:	6144:3o4V9ynqKoxhi0gAsfLBhJJzhGIVrdhoHuLFGAJmKApt5psaLGBFahKGRd67XLEm:LyncxQRhJJzhoqgH5sB4dxHG
MD5:	5AFDA7C7D4F7085E744C2E7599279DB3
SHA1:	3A833EB7C6BE203F16799D7B7CCD8B8C9D439261
SHA-256:	F58C374FFCAAE4E36D740D90FBF7FE70D0ABB7328CD9AF3A0A7B70803E994BA4
SHA-512:	7CBBBEF742F56AF80F1012D7DA86FE5375AC05813045756FB45D0691C36EF13C069361457500BA4200157D5EE7922FD118BF4C0635E5192E3F8C6183FD580944
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u.3..........." ..0............../... ...@....... ....................................`.....................................O....@..T....................`.......-..8............................................ ............... ..H............text........ ...................... ..`.rsrc...T....@......................@..@.reloc.......`......................@..B........................H........t......................x-........................................(......(......{...."..}......(&...:.(&.....}...."..('.....(......{ ..."..} .....{!..."..}!.....{"..."..}".....{#..."..}#.....{$..."..}$.....{...>..}.....(......{+...>..}+.....(......{%..."..}%.....0...........{&......(....-....(....6..s....}&....0...........{'......(....-....(....6..s....}'....0...........{(......(....-....(....6..s....}(...*.0...........{)......(....-.

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\SharpRaven.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	117080
Entropy (8bit):	6.406215603644869
Encrypted:	false
SSDEEP:	1536:WKKw4TfSgLOwanNdGzV9P23rl0LnITwa8yNpgwoIhAm7lPxHPxS:WKKBrbanrp0k38yNumrZxvxS
MD5:	89A2762F19597B82D5C501366E5B2F29
SHA1:	F5DF7962015164E4BFED0AE361F988C1E581677E
SHA-256:	A236377DB9EE299087C4F8FA6E345765AC4A25AA5D7FABFD8B724F1889324167
SHA-512:	BD2A4AB78835092ABB0CF3CAE0850C8B2AA344247F6479CFD59D52BBA60C4B605ADA4BF885E1AB0B86D4FAB138A9084900B954E62E6384D794F2CE61C999CB13
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....~..........." ..0..x..........N.... ........... ...............................I....`.....................................O.......................XI..........8...T............................................ ............... ..H............text...\|v... ...x.................. ..`.rsrc................z..............@..@.reloc...............~..............@..B................/.......H.......,................................................................0............r...p( ...t;....+.....0...........~.....+..".(!....Vr...p("...u............0..T........(#......(......,.r...ps$...z....s%...}......{....(....}......{....(....%-.&r...pr...ps&...z}......{....o'...}......{....(....}......{....(....}....rQ..p......%..{....o(....%..{....o)....%..(.....q....%..(.....%..(.....(......s%...}....r...p......%..{....o(....%..{....o)....%..(.....q....%..(.....(...

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\System.Data.SQLite.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	345600
Entropy (8bit):	5.986532957924007
Encrypted:	false
SSDEEP:	6144:o4xtlRVuJ4v4pFNFaFeFOFwcGF6cmFWc0FWc8cIcKcUFJFpcNcHc7cbchFFc5cb2:Vljdv4pFNFaFeFOFwcGF6cmFWc0FWc81
MD5:	AE8E6840BCFCE9AB0F6DB77A5F60CA1A
SHA1:	0981E864217C2EC5C67CED185458010E4BEDAC6F
SHA-256:	DAFA4A7E1186E5FE8223317F654795B9142D72917006EDAD03EE3D1DE5162BC6
SHA-512:	B3C3EA043CC8A286C9B7684FA7402534E2AB61D3EA9605CBF65EF88E1AF13A2EFA4E4911C2BFC1518B33A315D098E72CEBC04F8B47967ADF6CFFA2AD7765F5A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...I..Y...........!.....<..........^[... ...`....... ..............................7.....`..................................[..W....`.. ............................Y............................................... ............... ..H............text...d;... ...<.................. ..`.rsrc... ....`.......>..............@..@.reloc...............D..............@..B................@[......H...........8...................P ......................................1.9v'.J..b.r.4.t...,9.p\|.A.....a.....tl..........i\z9......Q.uo.x...O...a.#..I........h.#.\.3f._QA8No....YR..J.S.w..O. ..1:.(......}......{....:.(......}......{....r.(......}......}......}......0..5........-..~.....o.....X...r....~.......o......o .........6..(....(...."..(.....0..T........~!...("...-..-.~#...../....+...X....($...-..-.~#.....r........(%...~.......o&...Z.~....2..~.........

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\System.Runtime.InteropServices.RuntimeInformation.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33256
Entropy (8bit):	6.470050941710262
Encrypted:	false
SSDEEP:	768:vn1VM0JrpNWDcIh6leOiDFIFBYp1+ziBEBMf:vnvXYcIh6yFIFBYpczyEBMf
MD5:	82DEB78891F430007E871A35CE28FAC4
SHA1:	4E490D7EC139A6CDE53E3932D3122A48AA379904
SHA-256:	2F141B72A2AF0458993E27559395D8A8CDB0B752D79B1703541A61E728B55237
SHA-512:	E47F741AA9153CFAFC5F6BE39987D7C7D8FB745566C4D9A4525B9F30CBE6DF450D27BCDF8998DEC7AF824A7BE0F5E9EECAD2A39072B956A6320D23D94A0DA71A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...Ub.X.........." ..0..8...........W... ...`....... ....................................@.................................dW..O....`...............B...?..........,V............................................... ............... ..H............text....7... ...8.................. ..`.rsrc........`.......:..............@..@.reloc...............@..............@..B.................W......H.......4%..p/...........T.......U......................................r~....-.(....s.........~.......0..$.........(.....o.......&...,....o....,.....................,!(....,..r...p.(....(......(......(....,.r...p......%...%...(...........%...(.....(....,.r...p......%...%...%...(...........%...%...(......0..A.......(....,!r...p......%...%...%...%...(...........%...%...%...(....2r...p.(..........(....2(.....(....^~....-.(.........~....*..0..........~..........(

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ar\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14336
Entropy (8bit):	4.826476474631942
Encrypted:	false
SSDEEP:	192:9EElH3MyibplwgmZjMrjZ9EComtTwUS7AwxzIS:9EMH8NUgmZjMrF+gttS7Awxn
MD5:	D77DD6AD632B8DB6C38E8BC03B2B35B3
SHA1:	C762A246482595069994A84D6E44831A45C8750E
SHA-256:	EB2B10A3D8D8EEF2102A384AA81A40DB57D13F611CAB19651CFE310FCEA5F46D
SHA-512:	50EAA8AB3B1344A5D1590ACC9689073FB27D0699A8AF986BB16B3B3BC070657BA2517B42584BD685DEFA97DB4D2E938CD08BA6E31FFB30A7AEBC0FF6D7E90700
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.................K... ...`....... ....................................@..................................K..S....`............................................................................... ............... ..H............text....,... ...................... ..`.rsrc........`.......0..............@..@.reloc...............6..............@..B.................K......H........G..............P ..Z'..........................................V'.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....J.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..GO.6Q.N.S.i4X..]9Y.`

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\be\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.018867704104175
Encrypted:	false
SSDEEP:	192:kEElHaevNpLDNA6nkDDRBKANwqN8r9b/UmTL8k2M1qcgtOuzh5v+jm5qTIx+S:kEMHRfLDy6KD3N1Wh/ZTHLw2jbTQ
MD5:	BFCEA82A293C9C056408B7572BE20DA8
SHA1:	81E6987262443E9DE5691B3FFD46EFA51E5AA896
SHA-256:	B6E8A22D64B07B8181162D7E1E0BCC161100D0895D226D451121248BEB272FE7
SHA-512:	FA83B39D2FD5D2E5A7ABB02EF514869E4BC93FA64316D3A57D96F48EA1A554D31FFB30914584C72269F0724F3AEB62719E8066774A0431E2EA147EF657DAA39C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.....0...........O... ...`....... ....................................@.................................dO..W....`............................................................................... ............... ..H............text..../... ...0.................. ..`.rsrc........`.......2..............@..@.reloc...............8..............@..B.................O......H.......hK..............P ...+...........................................+.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....J.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..GO.6Q.N.S.i4X..]9Y.`

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\bg\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	4.253115177704405
Encrypted:	false
SSDEEP:	96:N8GlJXsIb8j6S4Rr/NzSqleWaLse0lC6xS:NhrVzfeW+47S
MD5:	04C49B1F65DD46F6D8EE462766B881C1
SHA1:	EE9991B1B92F179DAFE86037CCD7ACD06B87E023
SHA-256:	A1F1AE9DFEDE95338BD165EA82AF175A5CCBF8F6572594F9859B71CD1D39ED87
SHA-512:	5867C657B9D48F96E0712DBFBD624288D8079B58E1113867C3DCDC70BC719B37890A821A5026DC1E55B028A63C7F04E050C74FB421C0462000B0DEB1EC8B9BB9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!................>0... ...@....... ....................................@................................../..O....@.......................`....................................................... ............... ..H............text...D.... ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B................ 0......H........+..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........u.j....;..\...9....#..........d......k........F. ..:3M.(DO.6Q.i4X..]9Y.`.S.l.[.m..t".\| ..}\...................2...........i...-...................t.......R...h.......)...(.......5.......}................C.a.n.c

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\cs\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.761313341387136
Encrypted:	false
SSDEEP:	192:798tTmMnBI0rTXVTVglMCCdcGQOZ27a4X6R2gLwjUyRS:79GqWu0rTXVTVglM7cDOCBs5LwjUD
MD5:	7F7D3909CB9699BED099301AB3749C7B
SHA1:	E3A5EE528CAC8EE4B03076D4E4D850E5152CB9C2
SHA-256:	59C64EE4323973147A4C544E084763F561361C3A64488EEBA7D55815647E2813
SHA-512:	EC2EE360A65D9EF864D7957840FD72CE09DD9A10D1EBBBAFEF4FDF952A0F57128E019E720110FF2265A74035B5162D9CC3D30EA5FFD7A331FEDAF40DA90CFCB2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.....(...........F... ...`....... ....................................@..................................F..O....`............................................................................... ............... ..H............text....&... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B.................F......H........B..............P ..O"..........................................K".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\da\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.618243532839823
Encrypted:	false
SSDEEP:	192:5v98ShHYZXXIxiuVn7sg3Uqej8I2wH3d15701RrgS:R93ZUX8FBv31I2ag
MD5:	6836263CD2C4DA50B16D1EA72C9DB057
SHA1:	8669103CD2C3DCEDB9138DB2FF6900FF9274FAE6
SHA-256:	24EFB631475EE0FC545DCFB73641162B0D186BF2CF216C0D20C274C0DEB5FE61
SHA-512:	CFB33071D7BDD6CED4718B81C982D48C09A9A43DD8917DB449C96008FC767423D7A39CA283A2CE64D02FCD4F58C93A566B6F267F46F64B2FD84F827B50B5E98E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.....&...........E... ...`....... ....................................@.................................hE..S....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H.......lA..............P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\de\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.672241120621521
Encrypted:	false
SSDEEP:	192:J98t7B4RbSDKWz+XH/FA1Fn3MqqxtqZl7r4eQyjOrokSXkviS:J9G2tSqX+8QM
MD5:	FEAE38EA4C49BAE40F00A0001F20C41E
SHA1:	9B92443570F57D12901BAE5639CB2D191090407A
SHA-256:	9C957414B6F04BBA1D42CFCEF75F7217F77A05169359654CB22A338C15C006BA
SHA-512:	4342FD879A7A54F465096966C72CD31AE66BC01F26BC53C636ECCE7B7ADB58924161EECBCA277A6D436BE545138B565F91D7768D8BBB26BBC80310A18287098B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!................I... ...`....... ....................................@..................................I..O....`............................................................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................I......H........E..............P ..N%..........................................J%.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\es\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.592681518414427
Encrypted:	false
SSDEEP:	96:CeISeIM//sFzZqnkyMvR/8tbS+ejl6eGnrU5NkyCTKyfnR6ndXQ4JEo4qHkOBBJ7:H98EZEZZo4sqLU4WFebBRnS
MD5:	03FC2A26C6F654B9C43E5321B4EE9E22
SHA1:	6CB281B0EFC7CCF2773606FE0025934621C78FEC
SHA-256:	AA75EAD8433F5F4D05B783F25A305E80AE152F8C5D30AD0AF9EF03F82220ED9E
SHA-512:	A041FFD1ABA5BCB99A875D096307A7A7756578406CFABB89A6741404ED899FABADA3600C88D570F90B848436423836C6AE4CAC7328C03EF6F3F8594B817BE408
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.....(..........>G... ...`....... ....................................@..................................F..O....`............................................................................... ............... ..H............text...D'... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B................ G......H........B..............P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\fa\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.389745250080604
Encrypted:	false
SSDEEP:	96:c5rm7l8xH2Bj09orw2R2KkKc1xAZMh0lC6oS:chmVBQ1xnqeS
MD5:	DF394E7864D02B582C84F150029524A1
SHA1:	CC104C93CA6555FCE1BFFD2F501492BF33C4032E
SHA-256:	45A53D7E8EA5B0654B8E45392D38E2236E107CB222A51D7DB095338C9C791C6E
SHA-512:	76A60CDF8D3463FC53A674E22E3883929676EF05CB9736FC6876765191CE1561B99F7C92B04A972233085725B5E011393DE86C654C43B9334224E023146BB0C2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.................2... ...@....... ....................................@.................................`2..K....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................2......H.......d...............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....#.......PADPADP....../....u.j....;..\...9...7...#......... x...d......k........F. ..:3M.(DO.6Q.i4X..]9Y.`.G<c.0.c...jy.$l.S.l.[.m./zm..t".\| ..}....P...^.../...a...1.......u...................................................7.......

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\fr\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.605876291979368
Encrypted:	false
SSDEEP:	192:O989o5dDKlJZ6jwSVCuwuKjN/cTuiy5S:O9n5RYZInVMD/cLf
MD5:	A0DEA631C0C5B04B069DE00AD9A1D095
SHA1:	21C9014682B9526EADCE47D51AD4ECBC4B5CDD4B
SHA-256:	85B24F945ED58ED68DB4AFEA507E8C3DB306A468895FB1B27CC9D9014226938B
SHA-512:	C32BFF343575689EC4E443D2CBC7325C78CEC182497FA5963AAD73655CA0F685137869F0C404A96C11FAAE9709A8D4B6F86071E8A86AA0B1A7DEB4BA6401E1E6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!...............^H... ...`....... ....................................@..................................H..K....`............................................................................... ............... ..H............text...d(... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B................@H......H........D..............P ...#...........................................#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\he\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.715938609072634
Encrypted:	false
SSDEEP:	96:QGtSElVtUvBTPq/oxWpK643NTj4OnpXHI/yguKyQ8RKJdzkturVM37OtKt0qc2zW:tEElHKTtFfcMLYKtPA9auaZ3GKpS
MD5:	D721AB2C4AD22AAE1319AC04711D1CF7
SHA1:	732F7882FD65C3EBB18BBFE2B48EA07D749B4EC6
SHA-256:	9B3AD1521A77554F0BFA6528CD944FF59B29ECA3DECFEC9D048EB772959FCE06
SHA-512:	D9B5573B7CC626C7A59BD26ACF17945E393454255AFB92557F9B1D037A2884B9B72529002CD182D6BA42E554C8461A67C5DB6BD82653F9B954F3E7016D3650EC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!...............>I... ...`....... ....................................@..................................H..K....`............................................................................... ............... ..H............text...D)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B................ I......H........D..............P ...$...........................................$.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....J.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..GO.6Q.N.S.i4X..]9Y.`

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\hr\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.679620465982708
Encrypted:	false
SSDEEP:	96:4PISeIM//x3zTMAhxLo5Fp7zfHjU3CWk9GXFyteKymKjORhjYYAi14C7PE6J2IcZ:698FTown1QwkxXMuXQEhetKhppvS
MD5:	478F0BB7AA154D1F3756772EB0DB496F
SHA1:	CCAF743B9A0CA99EC7A81485A448C036F8443DBB
SHA-256:	35FA6CED31B8F2109F61EEA35F07D055DD5FAC228849AE197EFED30CDDF42123
SHA-512:	1F73586D139097908744E5236ECB790BF9943074BA3AE880D4A5F13A9F42AFD46BB1E73B2E5D3A82A0FEFF976F4625075FFA99ED130132D4EE833042DB7DD5C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.....(..........>G... ...`....... ....................................@..................................F..K....`............................................................................... ............... ..H............text...D'... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B................ G......H........B..............P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\hu\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.744056423209937
Encrypted:	false
SSDEEP:	96:jISeIM//ahl941hso/bVGtXV6QdIjXkdzSkE3yPhKyFcRaOq706Mi0R0RVGcrDNW:j98Y9uuIkO4DNBtcb+fF1wKv0Q0gtS
MD5:	B71F6039EDB51B89F44A58858AC53FDC
SHA1:	587D86A46D3E6E0BF43CF0FF54F4724F4CEB93E9
SHA-256:	9F0D7990721281A930207917F4953A7D298E10DCF7E52C7CD7EE05BC37905370
SHA-512:	0BA22B1EC77E426BE69EC698430822EEC730D013360F94943B98F7C2C2544F34B5902214E1510A7F1504890003E50807C93946923DEEAAA29DCCC70C7B4C76C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!...............~H... ...`....... ....................................@.................................,H..O....`............................................................................... ............... ..H............text....(... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B................`H......H.......0D..............P ...#...........................................#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\hy\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	4.221377087170206
Encrypted:	false
SSDEEP:	48:6OhHGF6qd3BawQUrvgWLKSj8MmZcuGi7CoZF34Zxseo0lC6GL3Qi3q1aNF0wEyGy:hI17gWLKSjzmCRuRoZWx0lC6Q3rS
MD5:	3FEAD3D72C2FCFA7917EAD13DD6A8853
SHA1:	472A675A892E7D3C84F231D172474776B54590D0
SHA-256:	72933C7973303FF9CB0299B0FE96FF7B5F47FACA50F7E7A127DCB5C4B0199138
SHA-512:	71BE383BCD94B4695F00D8F19BD9E474FE5D3BB959DBB8CA5000F3FEF5D4BC2C0109CE25C54AF953F400283D8706A37AD1779D66BDDAF4357EAE9F9525B94F56
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!..................... ...@....... ....................................@.................................X...S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B........................H.......\*..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP........u.j....;..\...9....#..........d......k......F. M.(D.i4X..]9Y.`.[.m..t".\| ..}................8...........Z...R...........K..........._...............o...,.......>...s...M....C.a.n.c.e.l.....<C.l.o.s.e.A.p.p.l.i.c.

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\id\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	4.590120341729785
Encrypted:	false
SSDEEP:	192:IcgmM27WuCKM0QgIzM5yFyHz+4xQfR1oOLE5VbBSDRvsvS7:IzmDquVMYTGR1HaS17
MD5:	37779F8425709B96D2182A9A9C6F30CD
SHA1:	30002550976398CC79D3503E0D005CBA5A1B68FF
SHA-256:	ABD4F59A40D306B62C042C5BCB00ECC728B16F674136A9A3808CBF2F9E2B1231
SHA-512:	C87E854E530103EC6642986A55370684B800C352EECCFED8C3F2DEC5736BB86AE465F739613B1DB7BBD1E69FAB48C0EEFE40940114DA4970C72AF36C42AA4826
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.....&...........E... ...`....... ....................................@.................................\E..O....`............................................................................... ............... ..H............text....%... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................E......H.......`A..............P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....I.......PADPADPc....94.......T.P.......n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..GO.6Q.N.S.i4X..]9Y.`.#.c

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\it\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	4.555777124893734
Encrypted:	false
SSDEEP:	192:X98bKiGsA/9JgUkb0fxHpYRjCmBXccXz5sgcTmSJyVqxmS:X9LiITgUkb0fxHpYRj9Xcc0rB
MD5:	4766FCC5D37391B7A33D9EE7C1149717
SHA1:	1BAFA5BF8938EF2F2FFED99F90B5ACAF44B5BF71
SHA-256:	D42245B5D0D8BFDB5DDD10A219AB201CFE6590833879F1231E08419B20EA1A84
SHA-512:	4C31C826EA9F0E43291296F750DBF2760285C4E821FB68E664E85DF83277DF61E46ABE866CA32BA9CB080553596F17B6EC74C1179DBC7FF36F5A64AE302B8663
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!...............~H... ...`....... ....................................@.................................$H..W....`............................................................................... ............... ..H............text....(... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B................`H......H.......(D..............P ...#...........................................#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ja\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	5.1320888524678265
Encrypted:	false
SSDEEP:	192:yW9883QZRQd3jWafoJ62Y5ycdXKSQWTyS:F9HQZRoTL15dBK4
MD5:	31CE98525E2D03F9DA1B42909E98B15F
SHA1:	A8A5ABD58FAB4044D1D0BE2E3054B8648D10B43B
SHA-256:	C3793F0A52F3134FF2C1BFB802513CF7BD5E883EE024FB8D8A8E41531615AE24
SHA-512:	97CCECB8FB0A9A772888F3EBDB0E9EBF864A4E5D2BAD6BD1EE5DDB8FA14649E78B986DF7E7D46AD0DB9AEF9500FD91A9697E058E37DC39E02DDC5C833DD443DF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.....0..........^N... ...`....... ....................................@..................................N..W....`............................................................................... ............... ..H............text...d.... ...0.................. ..`.rsrc........`.......2..............@..@.reloc...............8..............@..B................@N......H........J..............P ...)...........................................).............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ko\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.193477795061395
Encrypted:	false
SSDEEP:	192:0986vf9yP/K2TLRf/ARwbMLBJOJa+7t1S:09NfCi2TVf/ARh9cJPa
MD5:	83BBD97339B316AF6B06307079AF365A
SHA1:	5D2A5A6BF095FDCF4EDEB8C376297BA2F96F1351
SHA-256:	A25C1ED962334139106C2777BB21D5D985463AB8BFCBE9CB1F4D91A64C1C80CF
SHA-512:	0547DF12021F75243595E9B44A30BAC97A0F9BF3818577925A7FB0D2DE1F00ED0AB85BE0D97D6C589679EB7AF54B7C507BB530508EF38D3B6D27B58CC3AE0EBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!................I... ...`....... ....................................@..................................H..S....`............................................................................... ............... ..H............text...4)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................I......H........D..............P ...$...........................................$.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.cs.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.074559022913183
Encrypted:	false
SSDEEP:	48:6YzFcHQHlXONEo01G8+UPU9XCHA7ke6k6WDAR7Z0lEs//AP81Se6Bf5sd0w63Xbq:5Fc2V0l9ygg/kpOelEJ8mf5m
MD5:	484A394E0C7F707A291EF681CCF16A64
SHA1:	959A94C8A999C8F32939925033F2CC912F0FD305
SHA-256:	93D24DC0AE40105E6084FDEF821F3571A4147226389937869A8997A44678E3C7
SHA-512:	972A01C77CD927130218829377F927DC0F0270A3BBE4B058785E64A1563CC1702C31627FA99ACDFE5FA304BBD69C35B2AC138EAF7F5364C7B03E7B31E2F19C13
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e...........!.................... ...@....... ...............................J....@....................................W....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ......................................z3.1..1....'.D\|....Xx.Q.K...._.....O.i;..._c7... b0=..=..;..H..j..O#.T.d(UZ.g.v.Y.......w_.}....W..\|m$......o"!.I.'..E.n...[...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.da.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.9336444521993568
Encrypted:	false
SSDEEP:	48:6NQLY9u1HQHlXONELRqt8Hu49Xl0AGk4dKHb0a2xfqo1/Z0lEs//APa1Se6Bfhs5:49Q2j4W91bdbH4p5FwlEJymfhm
MD5:	3D342A975D564094C39A417490819D64
SHA1:	698FFA49D0FB26FE45F1F8F06D160AFADAD6B4DD
SHA-256:	B43AFD973126C3570DB9191372719721E126CE82F52A000DC581A831F1B413D1
SHA-512:	EE22BA4529692F49F89DCC943E018B9B360038D052B7D9EB04E7839776A52B7782F97695BE26D7C74F08EBD9B1AE15B6D194303C685D0FD42A21BFEA28B5DA0D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e...........!.................... ...@....... ..............................Be....@.................................\..O....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H.......l&............... ......P ........................................#.......\.-....V...9.$y...:..c.:+.O.t%....YL.`58.U......f.K]........=.3...V5.uNe_.o....t=gY.....^.ztb..W.y.c....D..6................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.*......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.de.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.0597349785125285
Encrypted:	false
SSDEEP:	48:6dZ+UHQHlXVN+cGuPI8otc+HW9XYYAVcDlYw8K3wZ0lEs//APX1Se6Bf6sd0w63W:6+U2MughBW9IXElYFWHlEJtmf6m
MD5:	8A3FC3621B4A4E758A0F5DEBDE7260B7
SHA1:	711B2C5573EF301F1FDEC24E622D6F1E0168DCCA
SHA-256:	E9F91C2BDF266A2FF49E3167764A2BBBE4E3D9BB2F84EFC787B4B97E7E6B9D93
SHA-512:	B9A003966B45DEF11FD053E6F27930C28B83C0330F825788AB0BCBB0830EC5063FED0EEED12FBA69A29EA0C83550B326044CBC23103C89673E2F34E71FFF9312
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e...........!.................+... ...@....... ....................................@....................................S....@.. ....................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................+......H........&............... ......P ..........................................tF.....`.mf>.!.("`.<9.A.g>8.....U....u^p_.]f...j.....`.....WVR....F.Z....2 ..'.[..m........[...8..B#.u.S....p..}.(.z...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.*......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.es.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.06905348555268
Encrypted:	false
SSDEEP:	48:6O62ptoHQHlXVN+/87sEC8OJc9XUkAbDi4nhQnN98Z0lEs//APFL1Se6BfWsd0w1:1pK2NO29kr6qh2rrlEJbmfWm
MD5:	1C6D7D0F1DF6DCAA8A5D53BA2547BDFF
SHA1:	2379DDE0288DFDAAF1890E58E3EE490DA6C830B7
SHA-256:	C9543ABB37F8A0B4C0F05DC95E6D2B3A1D3594AE63DC2BD229C0395852F171F1
SHA-512:	026B5715640779826FF27E78C5A7F33FA9DE54264637E10169F9E4406F1D80D72B5F0CA18BC45D81E75102ADD691B3123C1274C13D974B7F12FE68136977B4AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e...........!................>+... ...@....... ...............................5....@....................................W....@.. ....................`....................................................... ............... ..H............text...D.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B................ +......H........&............... ..$...P .......................................5.a.._V.1.}.C.7..h1~.Xsx.Q.p.....:3....k.$.....]wJP.V.5...?{....5..nt3..X~_y.r...2..I....r..$...K.MWJT.{_inf7d...ldp..g. ..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.*......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.fr.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.060712697555828
Encrypted:	false
SSDEEP:	48:6b+9GMrHQHlXVN+y27sBC8OJnWu9XOu+AUJpJEvUTROtqbjuVVhse3Z0lEs//APD:Ii2CTP9eMNSROtq29svlEJCmfSm
MD5:	575AF4C7557027D72C71AD689F3EFCCA
SHA1:	FD216FEC9F31B4B2E4A4938078384CA06B095431
SHA-256:	53186B8ECF89FBB06A2A667A00215180B26954BC0E3159BC3F8B2B796C704323
SHA-512:	91F5BB63FE887BE1EF80A0C7A25CBE1C1178C0D99C2B603A2864F7869719AF88D58F3ED420D3382FB85C1A51C4831A51ED09C7EFA8DBC6CE72E248E137B74262
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e...........!.................+... ...@....... ..............................\_....@....................................K....@.. ....................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................+......H........&............... ......P ....................................../w.:l..E.mgD.k.4.K..@..QV..0.OlDD......{.......,.~n........;..)\...wXh.h..T.M...u..$k...Nz.zzjn'....g....r..-0[Z..l..k`.C;.................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.it.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.038906102020568
Encrypted:	false
SSDEEP:	48:6gHzjwHQHlXONEosS685ew9Xia9AWkWVX7mBaIcUQNZ0lEs//APL1Se6Bf1sd0w1:7w29jQ9SaGNnhc2lEJhmf1m
MD5:	D8D4D43FC4CFE381D92EE5A1166507FF
SHA1:	BE282BF923690F68779B227A5DE478C565A8E1F8
SHA-256:	66E238C731D0BA50E090672D9C350747747A7EB8F7CCE05BE5241B6418D84C56
SHA-512:	68B93E17766608B32E22EC219BAAD9B60978CE0E9FDF71473319D8C35ECA0100AC1C046E6716D8894FD8576CEF4D8306329E7666C105A3F126CDF5A79DC13B4B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e...........!.................+... ...@....... ....................................@....................................K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ............................................].H:JN.......6e......K....#Y..N!..=.0~Pk.....d.r...H'.c.I.c.C..3..........Pt...);&..L...q=.....5.......@......C.g!...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.ja.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.439122732347798
Encrypted:	false
SSDEEP:	48:6y8BHQHlXONEgH1zH8Ypg49XSpAck6jQEsXc4CSYrVVq3IZ0lEs//APpRr1Se6BV:I2K1DHD9iqjqQEacyYpVq3flEJRmfSm
MD5:	539475FA947BFE24C6282C8488694617
SHA1:	F7792F1CDC3A2DA710BCC88A7866943DB1E763EA
SHA-256:	D30E5696DA3D2C3A9358B7CF48255BB1DCD3734C93BB22B50CC3FBF90C050DB4
SHA-512:	5DA3430FE6F78A8288ED66F240CE3B8A7D8ABEAD7B06C7A18C26DF341AB2B6354CA16FA185FBBC0463AD03ED3611F28C285E26D9FC0050C3E4690E63705BE453
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e...........!.................+... ...@....... ....................................@.................................`+..K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................+......H.......p'............... ......P ......................................E...W..d....W..n.a..[....Yp.3..C..v.s....`U....M.....Mq%...4.9........u+...........Y.X..f.R..]..l......m${Tk{.......F...$...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.*......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.ko.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.30959425816565
Encrypted:	false
SSDEEP:	48:6QPTgcRNHQHlX7NyVj1oDT480Jgq9XBaAlCkt8/L22lb7YYbZ0lEs//AP5Il1SeO:h/26poQp9RRIkbg7Y/lEJBMmfKm
MD5:	99ED66491257A255F14510C2EF369A35
SHA1:	828691599A0D82D0064517AF514D57A26BC7F5E7
SHA-256:	08575805E5C57E229EE1D7799EFDA670D3187631AFBAFB58B60A6FD4A48E6D72
SHA-512:	A05BE960F96B68A7A15AD6532E011415FC2926FCB79F2FDA9DA4F5FCA0596D2D59D1E21CB28878C0E06BD5192564AD920722137B169C357873923217F3F4CCC5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e...........!................>+... ...@....... ...............................o....@....................................S....@.. ....................`....................................................... ............... ..H............text...D.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B................ +......H........&............... ..%...P .......................................`.....k!N.Z.#zh.r(j.....2E..)..9.j{.y.T.....>\|9H.3D...e.jq..p....E.....&..w;....`WH.0 6.i.H.W...u..+..[...D....;..:...).q!..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.nl.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	3.9904549156857074
Encrypted:	false
SSDEEP:	48:65qUodheHQHlXVN+cz2E8vc2pb19XTgAub37HVSQPWoy5RAZ0lEs//APPf1Se6BQ:BUr2Bh419D/uXEysP3lEJ39mfFm
MD5:	F826070C6918617B8ED9DFB8DF671E5E
SHA1:	F45F3CED22BB466B7D505729890C72E4926F88E0
SHA-256:	1DE5E6A1A155C90858B5D3A6A262D093DF8607D5212CA6ADC131B9AAD58E9C9D
SHA-512:	903FEFA2BC7086B484227438FE1D91E7AA4A28A59F97E1EDF5294FF921E73E4266CC22D30B8CA345D8227448A958C0D9F033DAD8A31AE36E1DF1B8147E7C3D3D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e...........!.................... ...@....... ...............................:....@....................................K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ........................................8..U.">g...d..N]..\.pK`.h.vd.. .'....`.....^j. .q...;.$E..Y......y6[...iV.......'........2.Cr'Z.(HR...@.'%1...V.2})L...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.pl.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.05281083975718
Encrypted:	false
SSDEEP:	48:6+SKn6/HQHlXONELGKE84zp9XYtAokiJrnyOlY+gZ0lEs//AP41Se6BfVsd0w63W:li2M9H9IW3syOlYalEJImfVm
MD5:	E7F033CD1A85A9F0C136C7BF103106C1
SHA1:	975AF36CCBFD1D6ED2AF729505D00E1896B373D7
SHA-256:	416A7FD7DE91E44F9C075D59CD2D404FC7354EB797E66A06837B7D65E4D7CEA8
SHA-512:	47FFE27AFF5904E0837D27F97745B9E9D873C708D3852FFDAB2BB8E504A08BA95652DFE1F5A63E5D844F083F81D034F23C30F09B55AAF3B955DF139DDBB5A4AB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e...........!.................... ...@....... ...............................@....@....................................K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ......................................\......Z../.....9.M#W.`...b...^.!....5rq.2..? .3.j5+..an..x..y......J.1.&7...m.....W{U..;.^..gIZ..^.~......e.../=W....yfP{................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.pt-PT.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.063549350932302
Encrypted:	false
SSDEEP:	48:6FWlEbZeHQHlXVN+/FB480fB9XXgA9Dah4elgQCkhRO50lEs//A+H+1Se6Bf5sdD:0bZe2k2X9H/27nC2RtlEJ2umf5m
MD5:	3CF98866354E99275F821159A2B50217
SHA1:	8B8344EA0DBC821488FA979BB168140C2FEF34CF
SHA-256:	DEEB86D3C6BC00E158125B662B5D3D3EA53E958E72DA22FA6655513064380E76
SHA-512:	47D2C7EB3D2767A868507B462C4B8502946ED40B55D9277BEEA03A95452C37DCA0632C19ABE9B8DD6F44533A16BD820289358FC1611288C975C5B8C9498F7F64
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e...........!.................+... ...@....... ....................................@....................................W....@.. ....................`....................................................... ............... ..H............text...4.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................+......H........&............... ......P ............................................K....o#...0_.........D.t.W.z.n[N.w.,.j!@.].v..$.5......)b2>`.h7@.`.V.G.Q#3.@:.~..?..M.3fe.qXr..\|j.1..?....pM1..2.O.]y...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.pt.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.059842929133207
Encrypted:	false
SSDEEP:	48:65nU6F4HQHlXVN+/1od3lpc88jLc+9XLl+AhDk7QPkhRO50lEs//A+CNO1Se6Bf4:8U6i2aod3laRh9blNpP2RtlEJJ+mfVm
MD5:	B8A3EAEFB4FC76C60E0A5B533067C037
SHA1:	43E1791FD7AD5D48D51330AFD90F96D2AA3362F4
SHA-256:	DE0CDD79F0466EE12BD34752C8C284983EA3A8E195DCC9EF7BD81E2EA3DACD32
SHA-512:	D6102EAC82D76B3FCCC5F444EE7C0012786CCF4AC710B787C86165DD518920CBAFB285748B75D4BA8F8416454B96AF4AAA75357FA0DFE2F40301BCE1D9F4CDB4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e...........!.................+... ...@....... ...................................@....................................K....@.. ....................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................+......H........&............... ......P .............................................{u..$..CH..9..........TM.p.P.\..M........U...1.<6..7...C..b....-:..c.T....Q........H..q....&3G..o...X.......O..;..................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.ru.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	6144
Entropy (8bit):	4.157133490124049
Encrypted:	false
SSDEEP:	48:62ti8lEYHQHlXnNgZXyrubV850h9X0aKAvuqRwx9UqBE1LcNXH+ILZ0lEs//APl6:J12g4rupD9XhsQqyebOlEJtNmfam
MD5:	A440AE60F052F766F9E299C19AA2761C
SHA1:	20A485B233F8FD2E6394C2F316BC7A9C40330CC0
SHA-256:	295020DEFFEB9979CA01786680DA92C68B09978105DC6AEACFB400A024690C8E
SHA-512:	6C2AC52DC3CB484A0C6918E62925DBB049378B09E837A5FD960DCCF61EF275AA4F1F347E9015CE18AC637A0BC9923BC84D8E968658FE5B8D09F70DE5043D518B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e...........!.................,... ...@....... ...............................?....@..................................+..S....@.. ....................`....................................................... ............... ..H............text...$.... ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.................,......H........'............... ......P .......................................j#...i.......(.X.;g.Eo.G.4Lc,.....x}va......SJ./.:r.....(....Y...A../..`\,M...."...6...fS..(.k'......z/............................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.sk.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.072407222368628
Encrypted:	false
SSDEEP:	48:64JaQ6cZhHQHlXONEVHg7Q8NkjWu9XPJA2k8it+SEVovWaCZ0lEs//APE1Se6BfI:Lf2//39fKtb0nVovjlEJkmflm
MD5:	AD004846F02C26DAB27E34E0F5024429
SHA1:	CDDA0FA6CAF2C8B35D83909359A0331CCE2604A7
SHA-256:	41EC096D56D6D18331865A7972EC246214B6E366A11A2B22CA4F0D324D228274
SHA-512:	ED45A496839C807DC20530B638287437AAA361755F1E8564FF1959BAFD5DAC33794264C94ED582B550ECB3031649671440947D6622B4DB3FEEE79CC348CAF0A7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e...........!.................... ...@....... .............................._L....@....................................K....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P .......................................Z..>...6E>z.....[?U..-e..x[X...)....<....6.%.H.eCa_..mO4.kO....b..F...m.[bB=}d...$7Wa..)..3X..o'/.:..",...v.H......"g.LaG...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.sl.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.0242898893922
Encrypted:	false
SSDEEP:	48:6J6c5/WHQHlX7Nyo3Hz8olXgp9XHVAWOyqQlYAA/iDQrZ0lEs//AP41Se6BfxsdD:uv5/W27Thl89XeelEJImfxm
MD5:	53846EFF2C8026193BAF0B5C5514FD1C
SHA1:	8AE1452A8F6D22BDCC4EBE3DE929934301FA78A0
SHA-256:	88C33D7C0953249FECC310628AE347A930F90ED1EE3E252C15269B77E45B0756
SHA-512:	0853B682DF24DF18C791E9C5BCA0C36C7F39C2A9517FC81CA94500D6030CDF09B7D29209EA6A719932A48E92500116DD0B35E23E2778FD94D4941B210E5F9EE3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e...........!.................... ...@....... ....................................@....................................O....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ......................................f:..87..$..+.....q=....{5.N......4/...6../tf..........RC9.$1......Qj.TO{.4...U..$- .zM.bnm\|..B.0X..D...H........Yjf.....P...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.*......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.tr.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.0910651330651895
Encrypted:	false
SSDEEP:	48:6KaNBzhIvHQHlXQNg/mpo89hE+9XPZABiLlFFOy2dR7iRZ0lEs//APGd1Se6BfB6:as2K+w9f6BGl4F5lEJ+mfBm
MD5:	2F0B8FE738F0F399581BA3BB5815ED9C
SHA1:	C9FC99D13C48D5E8585828C1AAC0CB8F67887A34
SHA-256:	A9942AE66065BF732D4A474C62FF2A488A122C320DC8EC742BE6CA460E93B29B
SHA-512:	53EA156897FE74101FA6C496DD83DFCFD19B49CCA7A670F3AE553142F2CEA15EC385036BAEB3392433DAAB66AEFC8B69D1F1E98724C84CF477688DD9B5F283FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e...........!.................+... ...@....... ..............................."....@....................................O....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P .......................................X...:.7..$._...n........4..{e.4.....Z..o).[.* ..+..Y.U.l.....B....l.8Q.3.k......d....9..e...c.#.E...,,....m.=..).&.?..=..E ...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.*......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.zh-TW.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.2349680299479715
Encrypted:	false
SSDEEP:	48:6v5vCjvPIHQHlXONELhb4+8nKfq9XUeAz6k6AbZ9ky3eBy1550lEs//A+91Se6B0:uJ2TE+fi9ktFpfr3olEJYmfZm
MD5:	E646C2F56600B0732C2F7946E25B2137
SHA1:	D8DE2E24A3B99C4A33501A7B6E0CD06EF2393385
SHA-256:	E260B603855CBC7782AF291983F871D0ACBEEC3AB802647AF817B614F43CA703
SHA-512:	EA420F38FAE153EDB424071E1783066F99F256B3F8027A8292E27B54DBA91ACCD9440B287DC24004AF505F82AF5AC31CD603C9455FB9E956EA9FD6D3B20C6F76
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e...........!.................... ...@....... ....................................@....................................W....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P ...........................................L..{.W@.\{->T..\..Om`7..Q.$Wn..dBC0..j._.R..q..."g.:.56).wd.H..k..;=y..I...X..6(.]..}..K.S.\.PY..R)..\|.......;A..'...\|.P)...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\langs\AdGuard.CrashReporter.resources.zh.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	5632
Entropy (8bit):	4.201522274604354
Encrypted:	false
SSDEEP:	48:6r0ijPb+5HQHlXON2NsOVp+8CpTL9XFMAKSAneELusDHYZ0lEs//APMH1Se6Bfp6:QXz+52WOiN9VzRuPlEJamfpm
MD5:	7FBACCB829F154CE29B8ABE9A394D46A
SHA1:	D70585501C52F2167F0F6A2E05BFD862230ACA12
SHA-256:	E12DDDF8854D5E37F14C01D18CFF7C88D3463EE21D3C601F2F3F55A62A0B8A6F
SHA-512:	704B1C9ED7A24B19CE2A4B65CD19088B128A06E1144C2EB154CC25DCFA9EF1ECDF23039F9D79E5BA83E506B9D5825086A2F36195B7B69C291E296A843A216954
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....e...........!.................... ...@....... ..............................m.....@.................................t..W....@.. ....................`....................................................... ............... ..H............text........ ...................... ..`.rsrc... ....@......................@..@.reloc.......`......................@..B.......................H........&............... ......P .......................................~75_~..B.....S%..+#F(!W...j.uaq.uw...`b...8.K.5C ....$.O..x.o.G.0.......=......y.y[.\|E.jG.cY.J.Y.{.\|....e.#.......2..p...2...............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP.......Lv.@....u.m.......1...<....m...."!e%++..-.&{G[._.T.r............................E...y...

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\mbahost.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	122288
Entropy (8bit):	6.643662045821993
Encrypted:	false
SSDEEP:	3072:iyjfrCvv4JR5zsemsABCF0TPSLNegl/+b:xrrCYRsehsIX/E
MD5:	C59832217903CE88793A6C40888E3CAE
SHA1:	6D9FACABF41DCF53281897764D467696780623B8
SHA-256:	9DFA1BC5D2AB4C652304976978749141B8C312784B05CB577F338A0AA91330DB
SHA-512:	1B1F4CB2E3FA57CB481E28A967B19A6FEFA74F3C77A3F3214A6B09E11CEB20AE428D036929F000710B4EB24A2C57D5D7DFE39661D5A1F48EE69A02D83381D1A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........v........................}.......\|..............................o..............2~......2~......2~q.............2~......Rich....................PE..L...Tp.]...........!.....&..........(>.......@.......................................;....@.....................................x......................................T...........................H...@............@...............................text....%.......&.................. ..`.rdata...s...@...t...*..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\mbapreq.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	188848
Entropy (8bit):	6.598346436496911
Encrypted:	false
SSDEEP:	3072:iaVVzf0r2vM357+pwnohBIiv8+2kt2GOTALPN2obXbE7PKPU9+Wxhsz7CMD:iaLzfpIsHhBIqgGOTALFdbz7f
MD5:	FE7E0BD53F52E6630473C31299A49FDD
SHA1:	F706F45768BFB95F4C96DFA0BE36DF57AA863898
SHA-256:	2BEA14D70943A42D344E09B7C9DE5562FA7E109946E1C615DD584DA30D06CC80
SHA-512:	FEED48286B1E182996A3664F0FACDF42AAE3692D3D938EA004350C85764DB7A0BEA996DFDDF7A77149C0D4B8B776FB544E8B1CE5E9944086A5B1ED6A8A239A3C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......:v.O~.c.~.c.~.c....t.c......c....f.c.,.g.n.c.,.`.l.c.,.f.a.c.wo..z.c.wo..c.c.~.b.\|.c..~f.g.c..~c...c..~....c.~.....c..~a...c.Rich~.c.........PE..L...Yp.]...........!................................................................1.....@.........................`.......L...................................`.......T...........................H...@...............\............................text............................... ..`.rdata..2...........................@..@.data...............................@....rsrc...............................@..@.reloc..`...........................@..B........................................................................................................................................................................................................................................................................................

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\mbapreq.png

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PNG image data, 63 x 63, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.648767094164769
Encrypted:	false
SSDEEP:	12:6v/7rW3M/jDYAlFTzdvhKZ7e/cbp4/82UNb6MjmlKPNXheD1H0oJodqSXaTbutak:lQD1lldv8Z7g04/82Y6+Pxi19mDoqt5
MD5:	A356956FD269567B8F4612A33802637B
SHA1:	75AE41181581FD6376CA9CA88147011E48BF9A30
SHA-256:	A401A225ADDAF89110B4B0F6E8CF94779E7C0640BCDD2D670FFCF05AAB0DAD03
SHA-512:	A0F7836AEFA1747F481C116F6B085F503B5C09B3A1DD97CD2189F7CE4E6E7EA98F1F66503CBA2E6A83E873248CC7507328710DFA670AA5763DF8AEDCC560285E
Malicious:	false
Preview:	.PNG........IHDR...?...?.....W_......sRGB.........gAMA......a.....pHYs..........+......IDAThC./W.0....P(...Db+q8$.........J...-..8.e]._..;........Y... .Y....z\........{W\|..../q..<%.....C5...0....OrU....,..^........).....2.......i.Ge..T9T..}.7..J.......}..b...S.>.%y..Fc..j.X.....y."...e.U..M(ez....4\..C....u.......w..0..J.Wo."...mM.r.h..8..q..X..k!...j..xn...l...W`..r.+.R..J........c.T.}......cz..<43..@.c..rH...\|..V.....K.mN.........k....,..4OL..5..M.tm%=.U.t-7.w....k.R.....c...-].5~..]2..5...GA..[..={.5..].=(.$}.\.9..5...MWu..[#.....F..j.F...d...,..MWu.7..3......$.......G.t.....=;N<_:[......0.,1.y.\.Z.\|..%..>}...q.s....y.#p......!-.;.6!o.KO..E.6...........<..c..9_B....y....im...b...Xn.....)t9Q...........V.WMtP. .P..Z.&..KR.ac......IEND.B`.

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\mbapreq.thm

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3915
Entropy (8bit):	5.15881451198739
Encrypted:	false
SSDEEP:	48:cecHddpXBT2E/zPHWgtpmAPH8TSJmBP+NPHrM/O8YpQbFUuhJ3PK7usPH4Lr:wHdHxS4Z9UG4BmNjCOhpsB3PswP
MD5:	A20778EC90A094A62A6C3A6AB2A6DC7D
SHA1:	74C131B5FD80446FFDF2AFAD723762DD36621309
SHA-256:	F8C3A03F47F0B9B3C20F0522A2481DA28C77FECDBB302F8DD8FBED87758CBAEA
SHA-512:	47F34A9F416D223DCBF071E7292A05554AF3D27CDE67FC8C161C1BED564C6E7FC448C2F482E05F33149C782E09C681BD65730CA00CF9EC68B284128214B75529
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<Theme xmlns="http://wixtoolset.org/schemas/thmutil/2010">.. <Window Width="485" Height="300" HexStyle="100a0000" FontId="0">#(loc.Caption)</Window>.. <Font Id="0" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="1" Height="-24" Weight="500" Foreground="000000">Segoe UI</Font>.. <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>.. <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>.... <Image X="11" Y="11" Width="64" Height="64" ImageFile="mbapreq.png" Visible="yes"/>.. <Text X="80" Y="11" Width="-11" Height="96" FontId="1" Visible="yes" DisablePrefix="yes">#(loc.Title)</Text>.... <Page Name="Help">.. <Text X="11" Y="112" Width="-11" Height="30" FontId="2" DisablePrefix="yes">#(loc.HelpHeader

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\mbapreq.wxl

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2464
Entropy (8bit):	5.076345322304751
Encrypted:	false
SSDEEP:	48:cxX7DxMT8dbCsK19Wqq8+JIDxN3Wm2WcN3miNlLPDHXsmkaYXfXQ2BmGA7b1fABP:8LuTY1xmmmTerNR0AT1O
MD5:	4D2C8D10C5DCCA6B938B71C8F02CA8A8
SHA1:	11577021465379E9D1FF4260E607149BA5DFA6B3
SHA-256:	C63DE5F309502F9272402587A6BE22624D1BC2FEACD1BD33FB11E44CD6614B96
SHA-512:	AE791C1F05821167F1D2E1D07DBF95FE7E72B35B3E4B1E22720006C7A672B1330B748414792392B0E806F111AA4EFC1C424F4479EBDE349E3F079792DBB3BF47
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<WixLocalization Culture="en-us" Language="1033" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <String Id="Caption">[WixBundleName] Setup</String>.. <String Id="Title">Microsoft .NET Framework required for [WixBundleName] setup</String>.. <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>.. <String Id="HelpHeader">Setup Help</String>.. <String Id="HelpText">/passive \| /quiet - displays minimal UI with no prompts or displays no UI and.. no prompts. By default UI and all prompts are displayed...../norestart - suppress any attempts to restart. By default UI will prompt before restart.../log log.txt - logs to a specific file. By default a log file is created in %TEMP%.</String>.. <String Id="HelpClos

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\nl\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.600496805016585
Encrypted:	false
SSDEEP:	96:5DISeIM//EvdR7zSq/8uGkXB6jmIZQXBGtLy5NKyT1RxxAE2/xxx6ZxxxRZuM67z:d98S7VPQqfa6rZG+eLdm2DFdYS
MD5:	E1E889B8D8264E14395EDF527CE92C38
SHA1:	73ACFDED752F2CD5DB0DDBBBF07E7153904B17F5
SHA-256:	3C8C655A06C7A3CE2DAE6905001E5E3D2E0AFAF655B5B2C766CBF0485C1CC559
SHA-512:	84328FCE1736A9C39CA67FE7D1B43166F04CA0C4BC08713661B43382F028899D7407A863212EC69EF129A4F97A2866F8982498B30E73CCF0E20D464811477B62
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.....(..........nG... ...`....... ....................................@..................................G..O....`............................................................................... ............... ..H............text...t'... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B................PG......H....... C..............P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\no\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.250125073399912
Encrypted:	false
SSDEEP:	96:Cetiua6GpDOEbIe7S+j0lwaslvd8RtrMp9jma+4ZRjj0lC68S:HtpD/SpIWREWS
MD5:	B9DD20421881E03C44201325383BA528
SHA1:	A21209C59970C46A92B0C54E5C4FDC4DBD7F9471
SHA-256:	9E764534EDBA67A45ED3FA4352991972FACAE844B261DE799756070C54CB42D9
SHA-512:	9F75B81D0B8D1C47BAB4DFC91C86BDFFF2442C01A00566604469AA0D4B52DE177F58C942299C5842E9ABDBA435FFB62511B8F78FE85A7398A5EF4516FD3CD9BF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.................4... ...@....... ....................................@..................................4..S....@.......................`....................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................4......H........0..............P ..[...........................................W..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............PADPADP....../..bq....u.j....;..\....i......9...7...#............. x...n.(/\|..d......k....}.......F. ..:3..~CM.(DK..GO.6Q.i4X..]9Y.`.G<c.0.c...j\.}ky.$l.S.l.[.m./zm..t".\|...\| ..}............m...............................

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\pl\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.744274370916347
Encrypted:	false
SSDEEP:	192:R98zNQ2G7BRS22j3GktcW/rUrQovg91N+ZIz3zE8rS:R9WLG7fS22j3lrVov81NlUr
MD5:	5493E6D05F7D17F8B6F4F33E5ACBFD90
SHA1:	EEA4328B1FBCA2B4C3E7605900AD72529FD57A0D
SHA-256:	1C2C9EF54272BEEAFBEB16949F6D3745BC9967070F1EAC565A74E1835A81A915
SHA-512:	37D9EFEAE8A7999E1E2159078A0EC17F81E4FF0C3450B1E52FB9207CE455888DC9EEF7EFDCFBE609A7D2C8F9DEE5DAAB6F69EC47808EEA5AD800C6E588A803F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.....(...........G... ...`....... ....................................@..................................F..K....`............................................................................... ............... ..H............text...$'... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B.................G......H........B..............P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\pt-BR\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.658211406206287
Encrypted:	false
SSDEEP:	192:A98EV6XtFfg06LC7SbZfF07WIeU8mtZfyEB3yS:A9MXtFgLmSdt0K48m3fhZ
MD5:	3C3D13C2A1D22BA81EAA4B8D47ED10CC
SHA1:	814378928BC9D3A1944C6ECF487E02B668D00B5B
SHA-256:	24474C4D66E4D0CC22424FAC634B114E7BE7240D2BCE69AA49D268EB6844142E
SHA-512:	3E1E4CA9BF8FA077D1E387C94C73F625566CE13ED2DDD57B1A4630A73716318009552167C29AE4C90720874A8CE8DAEC6863FBC8ED15720322DC5D70C0B70C1A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.....(...........G... ...`....... ....................................@.................................HG..S....`............................................................................... ............... ..H............text....'... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B.................G......H.......DC..............P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\pt-PT\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.635209150622515
Encrypted:	false
SSDEEP:	192:I98OUeU0DY7sLBWdOwgxD5AGtDGBEOo72S:I9qeLD61OPViG9CWp
MD5:	96A3C629F652448331D039CBBCD96464
SHA1:	5EC2CB2F721AA81601609037FE17D6C6DABC0FBE
SHA-256:	24862DB7E35AC174D82436CC928DBB8164C0D2DBBD3A1E63550B7D14E3B30F05
SHA-512:	7071C3D9F9655E404DC7355441AA5D8AB1D114C1ECDE193F1A1DD0FD5D240DE72594012FF99659945BC49BFBDC4B6B1404A21C0FE5DB62AA2CE4E663779791F4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.....(..........nG... ...`....... ....................................@..................................G..W....`............................................................................... ............... ..H............text...t'... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B................PG......H........C..............P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ro\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.688431445978554
Encrypted:	false
SSDEEP:	96:9ISeIM//PJbby+xfAz1qRrjeaKszJj4NAs9/gGyueKy4dRVym9uQNALkPDtorY/o:998JHy+xfaiaXNumDtos/rbHkEgltQS
MD5:	5ECBB803F82CEF767B82E2D07F061383
SHA1:	D52EB26E42D78703AA096A76C0B06F2B0CBAA989
SHA-256:	77F3B835A547EA9BFE7C7886C3FADB7BA452B957132C9A73A17BCB14164AFBB4
SHA-512:	BAE7C78C94D44CAECAF76DFD9689672561EE10AA19272E2AC15FFBDAF9BB480FE2D765B9944FC0CDEFEAC8A107ED0B205F96C67287913267E73727CFDD893581
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.....(...........G... ...`....... ....................................@.................................TG..W....`............................................................................... ............... ..H............text....'... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B.................G......H.......XC..............P ...#...........................................#.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\ru\AdGuardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	4.95071694987002
Encrypted:	false
SSDEEP:	192:898ZBn/N7lHwpyhW3vJ+Lb6HnwX2skUSJGAS:89aVZHwpWWfiJm8J
MD5:	C3E9C57DB0B7B2E9B537E92E3493F4F4
SHA1:	47961E34ADC8DF77F0E7EF42CEE8D3BA27E08283
SHA-256:	48E13FB06B931FD00AB8AEE3FFB5D15CE219AF1DAF67532FA0164E2B6D42C56C
SHA-512:	2BA43770A88ED965EDD940DB6F841EF5994C2A2D3ABE8D9749F18292F9BB6897844695573856FF0A2897A4E6F2E67DF5444589C4DDF64442B99A8CBBBAB940BE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.....0...........O... ...`....... ....................................@..................................N..K....`............................................................................... ............... ..H............text...4/... ...0.................. ..`.rsrc........`.......2..............@..@.reloc...............8..............@..B.................O......H........J..............P ...........................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\sl\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.616385670644499
Encrypted:	false
SSDEEP:	192:f98tyhG8y0AL/2ptpwrRHwHU7Ozz91lrgUIf5lGYVg90S6alOZmlGFiHES:f9BG8cgtpwrRU9Rk/Kliy
MD5:	C1F78E24E51970B7DEA75470EF834A67
SHA1:	11E1DD317E009B6277244E580966900727B67230
SHA-256:	E0099B9368F0D0D54B3C7C5ABF9BED1F704DA5CB1D5E411EB5974AB8737D65D0
SHA-512:	D8B74FE4CD1E0FBAEE5CA39FCA5CA5BAE9E918D4027AE3FADA14BD0A7F8D1857978D6B706EE24425564D41CCE4283675E741E5B49BFF09CA59E735E3A96CD377
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.....(...........F... ...`....... ....................................@.................................@F..K....`............................................................................... ............... ..H............text....&... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B................pF......H.......DB..............P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\sr\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.584429496032124
Encrypted:	false
SSDEEP:	96:nISeIM//OHewo6ua3G7meBtCj/8yrmabRCyLlKy9BRsIdZriJ9l/Jt1ABHgsmoRm:n98ZwogfhGFGeSrY97BIoIv1COS
MD5:	5C959B7B12A0260CA73640F746F649C2
SHA1:	FCD38A1F26B3ECB62E05B6AC2869104CCD572476
SHA-256:	B06028779EAFA1914843428698990389E1C3CB1480E64238D3258C215394E27E
SHA-512:	2A34E11869D55085A2AEE325BF62F128B05B67E18D4B2D87ADEA0A608C6EFA3BF0058811D1B43CFA155B79ED43ED8BC3A59C90AAC57CB0BA0855D296B6D1133A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.....(...........F... ...`....... ....................................@.................................<F..O....`............................................................................... ............... ..H............text....&... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B................pF......H.......@B..............P ...!...........................................!.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\tr\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12800
Entropy (8bit):	4.739970992448437
Encrypted:	false
SSDEEP:	192:o98t9JS9OyZjF8S83y8fUw0R1ywoOXnS:o9G3AVZR8S83Oxywob
MD5:	1BC80CA31252B7D71D77780A9D872D89
SHA1:	6C8775B52EF24C4C7C842EBCD33C6E7B06794244
SHA-256:	1D1D9B878AF6197F92971D6A7843061E12816AEEB533040FEDFBF819FD773D4E
SHA-512:	2F4426CA8B19096F71D18D6233ED941DD1FED2509B4889540548EF50F01781DB2B1195F3810BC5B49DFBFD8DDD36D256630CF3F534ECAC27DB282F5793092D4B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.....(..........>G... ...`....... ....................................@..................................F..O....`............................................................................... ............... ..H............text...D'... ...(.................. ..`.rsrc........`.......*..............@..@.reloc...............0..............@..B................ G......H........B..............P ..."...........................................".............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\uk\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	14848
Entropy (8bit):	4.997933650312556
Encrypted:	false
SSDEEP:	384:By9FDrFuZWYl5cLVjwmq+rinxYXZTKgwmE5:BSFDrwvsPr+J
MD5:	95992014E0CA2D1B5A61037D52EB5D7C
SHA1:	078778DD9FABA7A01E6429DCA0E1E315504E6B9B
SHA-256:	B693AF76CD74419FFED4C882B28C4689A9D356454780E00CD0A96EEF2AF7FBE2
SHA-512:	7DDC374B69EF134E24BB6DF419F38F86B0B1A5845B4204BB2712468565F2458E11F49D7642AB6F35343F07E031D136799D12262BB98EEE45288CA363FAAFE0F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.....0...........O... ...`....... ....................................@.................................`O..K....`............................................................................... ............... ..H............text..../... ...0.................. ..`.rsrc........`.......2..............@..@.reloc...............8..............@..B.................O......H.......dK..............P ...+...........................................+.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\vi\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13824
Entropy (8bit):	4.96459329611053
Encrypted:	false
SSDEEP:	96:sISeIM//tPoezgfmfFnG4KL4og7jf3zfX91O640ySVKybeRagRRIqpOe0i3BfIWS:s98dgarZE0Mx35IWjVeDCWABnWlqLS
MD5:	DD539E8EC4122365765BDF09F7E1858A
SHA1:	D38957790F946F19B94A468A0C474E2A26E65081
SHA-256:	D5BD9FABA23711CA85D85D9E4D0837F51252153CD15F2D662D1D31B164A88628
SHA-512:	FB92ADB058C2C1ACB9FC34D6B91E86D44ED0FD44EF099FE46FAF25E30799B55A437BF567C7BFE5E0F083DB434CB4B5247D56D04FAF9CD2B91B952602AD4E96B3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.....,...........J... ...`....... ....................................@.................................@J..K....`............................................................................... ............... ..H............text....*... ...,.................. ..`.rsrc........`......................@..@.reloc...............4..............@..B................pJ......H.......DF..............P ...%...........................................%.............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\zh-TW\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.100914873461093
Encrypted:	false
SSDEEP:	96:XISeIM//sge9LH6G9a/XAoWihxW/j6TCZrT5L8Uy9SKyr4OR5lp4jOWeMFOCU4z7:X9809LH79N5UOWeq07OqJ8qFS
MD5:	139D1FD685A5542A5DC1E9A0D5F7A123
SHA1:	AFE8A92D0E73D0F7D4EAE67B289D538E8EDF1580
SHA-256:	AD451DF856E9C45978B9997584085E3D27D19A65C111F4C5239635B93A0624D1
SHA-512:	DC2B87FBBB8BA1FD75E3693CDBB59C2E340E8DB82A7CA9836503D8AF7705C3C484AE23334ECA3747EE6F154BACF2E53A62B14383FAA5CBA31BE3276533FF168A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.....&..........^D... ...`....... ....................................@..................................D..W....`............................................................................... ............... ..H............text...d$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B................@D......H........@..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\zh\AdguardVpn.Burn.resources.dll

Download File

Process:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	12288
Entropy (8bit):	5.072642532688912
Encrypted:	false
SSDEEP:	96:LaISeIM//dbUwC0/O2lAmz2otjKxAv8f6PtyEFKyGgRKeYsSnQaciCCFUm7vGEVq:La98awcONCnPvuEPbVi4PS
MD5:	FFB91FDB904074E03A0DF21403EF7583
SHA1:	9F2033B877C6A50CDFC969EC67122117AD560658
SHA-256:	A7DBA890388C96B32A89D9D0CEB2639A1004914E001CFBD6626676912153F14D
SHA-512:	C011D89CE66FE045B3314CDCC87ECB515D85C13A57ED64879A71411D2DBF92A24B5AA9E72EAA1A16C7F9772A17F96EE50C509CE9F4759EF0AD3D6203E4FE30DB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....j.e...........!.....&...........D... ...`....... ....................................@..................................C..W....`............................................................................... ............... ..H............text...4$... ...&.................. ..`.rsrc........`.......(..............@..@.reloc..............................@..B.................D......H........?..............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet....K.......PADPADPc....94.......T.P......._...n../..bq..a.Q...u.j....;..\........i.b.......g...Z..9...7..G....#............. x......n.(/\|..d..........k....}.O?...+........F. ...!.Q</..:3A..6..f8...9..z:..~CM.(DK..Gg..MO.6Q.N.S.i4X..]

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.981605939047917
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	TsU2RShnl7.exe
File size:	116'256 bytes
MD5:	5fd249a523f8006dae95752b5cf9bf49
SHA1:	e6e02da45574070c899c51f2400f9bd3171b02f0
SHA256:	443b3b9929156d71ed73e99850a671a89d4d0d38cc8acc7f286696dd4f24895e
SHA512:	1e0b370cde831f1fd135cbe7b0e1ce4ac2f7d58d0fe94d4df8db92e756affb35c3b5b7f6ccf4f03964869b3e8110673912175d5abac92742111d7f8fed32343d
SSDEEP:	3072:e4GZnrASj3/lQLFvGwFCZ+XH+IB8wvFxP:e4GZrr3/K1Btvn
TLSH:	02B3A00AFD4350F1F91B9970968BFB3F8630E22784149DA7FFC64B59E9627B2640A105
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...s..c...............'..........................@.................................h@....@... ............................

File Icon


Icon Hash:	0771d0d2250b3b8e

Static PE Info

General

Entrypoint:	0x4014b0
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6390A073 [Wed Dec 7 14:17:23 2022 UTC]
TLS Callbacks:	0x401780, 0x401730
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b26a7e001a4be269742be838dadc9db9

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	13/01/2023 00:00:00 12/01/2026 23:59:59
Subject Chain	CN=Adguard Software Limited, O=Adguard Software Limited, S=Lefkosia, C=CY
Version:	3
Thumbprint MD5:	97CB1ECDC7F0BCBB54ACA397BB03E6D1
Thumbprint SHA-1:	48BAFFCE2694F647A33854183A4B817BB8A7DBEA
Thumbprint SHA-256:	453226C42EB62A278F091B0155200D76DD284A1337795B6EB37A627D414F1284
Serial:	00B138E6660DCA7CC377CB2F6F6027F616

Entrypoint Preview

Instruction
mov dword ptr [0041106Ch], 00000001h
jmp 00007F6C0C6F3066h
nop
mov dword ptr [0041106Ch], 00000000h
jmp 00007F6C0C6F3056h
nop
sub esp, 1Ch
mov eax, dword ptr [esp+20h]
mov dword ptr [esp], eax
call 00007F6C0C6F969Eh
test eax, eax
sete al
add esp, 1Ch
movzx eax, al
neg eax
ret
nop
nop
nop
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 1Ch
mov dword ptr [esp], 0040E000h
call dword ptr [004125F4h]
sub esp, 04h
test eax, eax
je 00007F6C0C6F3425h
mov ebx, eax
mov dword ptr [esp], 0040E000h
call dword ptr [00412658h]
mov edi, dword ptr [00412608h]
sub esp, 04h
mov dword ptr [00411028h], eax
mov dword ptr [esp+04h], 0040E013h
mov dword ptr [esp], ebx
call edi
sub esp, 08h
mov esi, eax
mov dword ptr [esp+04h], 0040E029h
mov dword ptr [esp], ebx
call edi
mov dword ptr [0040D004h], eax
sub esp, 08h
test esi, esi
je 00007F6C0C6F33C3h
mov dword ptr [esp+04h], 0041102Ch
mov dword ptr [esp], 0040F104h
call esi
mov dword ptr [esp], 004015A0h
call 00007F6C0C6F3313h
lea esp, dword ptr [ebp-0Ch]
pop ebx
pop esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x12000	0x1d0c	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x16000	0x8310	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x19600	0x3020	.rsrc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1f000	0x7ac	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xe488	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x124cc	0x3dc	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xb0d4	0xb200	795976d8ade88f24cfb013314c16a55c	False	0.5650237008426966	data	6.245149254196926	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xd000	0x4a4	0x600	f2b46d01d6eaa30912819c23fcec88cb	False	0.10872395833333333	data	1.1421945641470137	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xe000	0xbe0	0xc00	cdeb491c9f8ed943fbfa4e5a64126cdd	False	0.5481770833333334	data	5.322586268721286	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.eh_fram	0xf000	0x1fb0	0x2000	923ae17274e756093759304ab472082f	False	0.3533935546875	data	4.933913732859542	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.bss	0x11000	0xa74	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x12000	0x1d0c	0x1e00	7cf265bc970978cf36ffcbe8a9a610da	False	0.375	SysEx File -	5.372660458640531	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.CRT	0x14000	0x34	0x200	4eef9a9546f6bf89752c594cebb6c33b	False	0.06640625	data	0.2601579489546485	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x15000	0x8	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x16000	0x8310	0x8310	ae5b95a827ccff784c6821860ea20c07	False	0.8662672865999046	data	7.582095818588735	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.reloc	0x1f000	0x7ac	0x800	cd529a2d5f29be6c2efba8641354c9db	False	0.84619140625	data	6.519804353028213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x16208	0xf3c	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	1.0028205128205128
RT_RCDATA	0x17148	0x236f	PNG image data, 440 x 270, 8-bit/color RGBA, non-interlaced	English	United States	0.9622974313747106
RT_RCDATA	0x194b8	0x40e2	PNG image data, 880 x 540, 8-bit/color RGBA, non-interlaced	English	United States	0.9057796508127633
RT_RCDATA	0x1d5a0	0xe0	PNG image data, 7 x 10, 8-bit/color RGBA, non-interlaced	English	United States	1.0133928571428572
RT_RCDATA	0x1d680	0x149	PNG image data, 14 x 20, 8-bit/color RGBA, non-interlaced	English	United States	1.0212765957446808
RT_GROUP_ICON	0x1d7d0	0x14	data	English	United States	1.05
RT_VERSION	0x1d7e8	0x260	data	English	United States	0.4753289473684211
RT_MANIFEST	0x1da48	0x3dd	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4620829120323559

Imports

DLL	Import
COMCTL32.DLL	ImageList_Create
COMDLG32.DLL	GetOpenFileNameW, GetSaveFileNameW
GDI32.dll	CreateCompatibleDC, CreateFontIndirectW, CreateSolidBrush, DeleteDC, DeleteObject, GetDeviceCaps, GetStockObject, SelectObject, SetBkMode, SetTextColor
gdiplus.dll	GdipAlloc, GdipCloneBrush, GdipCloneImage, GdipCreateBitmapFromStream, GdipCreateBitmapFromStreamICM, GdipCreateFromHDC, GdipCreateHBITMAPFromBitmap, GdipCreateSolidFill, GdipDeleteBrush, GdipDeleteGraphics, GdipDisposeImage, GdipFillRectangleI, GdipFree, GdipGetImageHeight, GdipGetImageWidth, GdiplusShutdown, GdiplusStartup
KERNEL32.dll	CancelWaitableTimer, CloseHandle, ConnectNamedPipe, CreateDirectoryW, CreateEventW, CreateFileMappingW, CreateFileW, CreateHardLinkW, CreateIoCompletionPort, CreateNamedPipeW, CreateProcessW, CreateThread, CreateWaitableTimerW, DeleteCriticalSection, DeleteFileW, DisconnectNamedPipe, EnterCriticalSection, ExpandEnvironmentStringsW, FindClose, FindFirstFileExW, FindFirstFileW, FindNextFileW, FindResourceW, FormatMessageW, FreeLibrary, GetCommandLineW, GetConsoleMode, GetCurrentProcess, GetCurrentProcessId, GetCurrentThread, GetCurrentThreadId, GetDiskFreeSpaceW, GetExitCodeProcess, GetExitCodeThread, GetFileAttributesExW, GetFileSizeEx, GetLastError, GetLocaleInfoW, GetLongPathNameW, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetNativeSystemInfo, GetNumberOfConsoleInputEvents, GetOverlappedResult, GetProcAddress, GetProcessHeap, GetProcessIoCounters, GetProcessTimes, GetQueuedCompletionStatus, GetStartupInfoA, GetSystemTimeAsFileTime, GetThreadTimes, GlobalAddAtomA, GlobalAlloc, GlobalDeleteAtom, GlobalFree, GlobalLock, GlobalUnlock, HeapAlloc, HeapFree, HeapReAlloc, InitializeCriticalSection, IsDBCSLeadByteEx, LeaveCriticalSection, LoadLibraryA, LoadLibraryExW, LoadResource, LockResource, MapViewOfFile, MoveFileExW, MultiByteToWideChar, PostQueuedCompletionStatus, QueryPerformanceFrequency, ReadConsoleInputW, ReadFile, RemoveDirectoryW, SetConsoleCtrlHandler, SetConsoleMode, SetDllDirectoryW, SetEndOfFile, SetEvent, SetFileAttributesW, SetFilePointerEx, SetLastError, SetUnhandledExceptionFilter, SetWaitableTimer, SizeofResource, Sleep, SwitchToThread, TlsGetValue, UnmapViewOfFile, VirtualProtect, VirtualQuery, WaitForSingleObject, WaitForSingleObjectEx, WideCharToMultiByte, WriteConsoleW, WriteFile
MSIMG32.DLL	AlphaBlend
msvcrt.dll	__getmainargs, __initenv, __lconv_init, __mb_cur_max, __p__acmdln, __p__commode, __p__fmode, __set_app_type, __setusermatherr, _amsg_exit, _cexit, _daylight, _errno, _initterm, _iob, _onexit, _stricmp, _timezone, _tzset, _wcsicmp, abort, atoi, calloc, exit, fprintf, fputc, free, fwrite, localeconv, malloc, memchr, memcpy, memset, qsort, setlocale, signal, strchr, strerror, strlen, strncmp, vfprintf, wcslen
ole32.dll	CreateStreamOnHGlobal
SHELL32.dll	DragFinish, DragQueryFileW, ExtractIconExW, ILCreateFromPathW, ILFree, SHOpenFolderAndSelectItems, ShellExecuteW, Shell_NotifyIconW
USER32.dll	CallWindowProcW, CloseClipboard, CreateAcceleratorTableW, CreateWindowExW, DefWindowProcW, DestroyAcceleratorTable, DestroyWindow, DispatchMessageW, EmptyClipboard, FillRect, GetClientRect, GetCursorPos, GetDC, GetFocus, GetMessageW, GetParent, GetWindowLongW, GetWindowPlacement, GetWindowRect, IsWindowVisible, LoadCursorW, LoadIconW, LoadImageW, MessageBoxW, OpenClipboard, PostMessageW, PostQuitMessage, PostThreadMessageW, RegisterClassExW, RegisterHotKey, ReleaseDC, ScreenToClient, SendMessageTimeoutW, SendMessageW, SetClipboardData, SetCursor, SetFocus, SetForegroundWindow, SetLayeredWindowAttributes, SetWindowLongW, SetWindowPlacement, SetWindowPos, ShowWindow, SystemParametersInfoW, TrackPopupMenuEx, TranslateAcceleratorW, TranslateMessage, UnregisterClassW, UnregisterHotKey, UpdateLayeredWindow
WININET.DLL	HttpQueryInfoA, InternetCloseHandle, InternetOpenUrlW, InternetOpenW, InternetReadFile

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 12, 2024 10:20:56.180181026 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.180227041 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.180341005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.192272902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.192290068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.389029026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.389122009 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.506378889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.506412983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.506881952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.506939888 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.512244940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.556241989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.627990961 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.628026009 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.628046036 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.628065109 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.628098011 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.628110886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.628139973 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.628159046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.718352079 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.718396902 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.718444109 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.718476057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.718497038 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.718528986 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.753204107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.753277063 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.753319025 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.753350019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.753371000 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.753395081 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.788137913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.788182974 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.788244963 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.788259983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.788296938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.788309097 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.810801983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.810863018 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.810941935 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.810981989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.811002970 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.811017990 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.836826086 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.836867094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.836951971 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.836988926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.837014914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.837028980 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.858356953 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.858392954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.858504057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.858532906 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.858582020 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.877445936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.877515078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.877556086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.877588987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.877605915 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.877634048 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.888519049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.888544083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.888617039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.888641119 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.888684988 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.899317026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.899342060 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.899425030 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.899466038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.899508953 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.911060095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.911084890 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.911161900 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.911175966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.911221981 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.920874119 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.920900106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.921006918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.921039104 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.921087027 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.931632042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.931658030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.931735992 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.931768894 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.931823015 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.940589905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.940612078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.940675974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.940705061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.940748930 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.950318098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.950355053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.950404882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.950417995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.950444937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.950454950 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.958529949 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.958555937 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.958623886 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.958646059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.958666086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.958684921 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.966212034 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.966259003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.966322899 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.966351032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.966370106 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.966397047 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.974397898 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.974448919 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.974488974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.974500895 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.974519968 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.974545002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.981101036 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.981146097 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.981194019 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.981204987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.981235981 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.981255054 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.988231897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.988250017 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.988337994 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.988363028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.988406897 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.993993998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.994013071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.994069099 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.994096041 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:56.994113922 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:56.994142056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.000349045 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.000369072 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.000442028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.000464916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.000479937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.000504017 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.005565882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.005587101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.005655050 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.005667925 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.005712032 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.011403084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.011467934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.011491060 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.011499882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.011543989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.011557102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.019150019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.019232988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.019233942 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.019265890 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.019299030 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.019311905 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.023041010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.023094893 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.023128986 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.023152113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.023169994 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.023210049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.027705908 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.027734995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.027780056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.027801037 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.027817011 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.027842045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.031779051 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.031800985 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.031852961 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.031862974 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.031900883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.031912088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.036402941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.036426067 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.036500931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.036530972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.036581993 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.040822983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.040841103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.040920019 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.040946960 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.040994883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.044362068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.044378996 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.044450045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.044481993 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.044498920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.044531107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.048093081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.048113108 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.048187017 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.048227072 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.048265934 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.051562071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.051579952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.051641941 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.051664114 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.051706076 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.055768967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.055787086 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.055845976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.055855989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.055896997 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.056668997 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.056688070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.056741953 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.056754112 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.056771994 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.056797028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.059876919 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.059895992 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.059947968 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.059963942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.059978008 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.060003996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.063848972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.063863993 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.063927889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.063941956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.063982964 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.070693016 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.070712090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.070760965 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.070786953 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.070805073 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.070832014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.072591066 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.072621107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.072655916 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.072665930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.072704077 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.072714090 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.075907946 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.075951099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.075978994 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.075993061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.076019049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.076034069 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.078596115 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.078614950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.078671932 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.078682899 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.078715086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.078723907 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.081645966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.081723928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.081734896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.081748962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.081808090 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.081818104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.085323095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.085345030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.085438967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.085477114 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.085520983 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.088063955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.088089943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.088143110 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.088154078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.088197947 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.088212013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.090703011 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.090719938 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.090780020 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.090800047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.090817928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.090848923 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.093364954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.093395948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.093435049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.093444109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.093480110 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.093492031 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.094434977 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.094450951 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.094513893 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.094523907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.094552040 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.094566107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.096916914 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.096935987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.096997976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.097007990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.097026110 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.097047091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.099541903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.099559069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.099613905 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.099623919 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.099642992 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.099668026 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.101994038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.102010012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.102066994 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.102091074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.102108955 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.102134943 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.106583118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.106599092 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.106656075 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.106669903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.106694937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.106708050 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.109086990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.109113932 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.109127045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.109179974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.109188080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.109246016 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.111799002 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.111819029 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.111875057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.111927032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.111968994 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.111989975 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.113532066 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.113548040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.113594055 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.113617897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.113646030 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.113665104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.116311073 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.116328955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.116385937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.116415024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.116444111 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.116470098 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.118962049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.118977070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.119041920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.119072914 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.119086981 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.119110107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.120920897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.120938063 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.120979071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.120989084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.121017933 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.121026039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.123306990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.123322964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.123362064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.123383045 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.123399973 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.123430967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.125278950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.125293016 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.125339031 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.125348091 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.125375032 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.125384092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.127607107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.127635002 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.127650976 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.127702951 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.127710104 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.127723932 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.127762079 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.129795074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.129808903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.129848957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.129872084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.129884005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.129941940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.131962061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.131978035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.132038116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.132054090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.132071018 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.132091045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.133810043 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.133825064 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.133877039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.133917093 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.133946896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.133968115 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.135629892 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.135760069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.135832071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.135838985 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.135860920 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.135907888 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.135909081 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.138288975 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.138304949 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.138370991 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.138420105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.138454914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.138477087 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.140002012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.140017033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.140073061 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.140094042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.140110016 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.140129089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.142105103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.142122030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.142165899 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.142175913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.142189026 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.142219067 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.144159079 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.144179106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.144241095 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.144253016 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.144265890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.144294024 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.145472050 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.145487070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.145528078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.145538092 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.145565987 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.145618916 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.147483110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.147531033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.147557974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.147567987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.147583961 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.147613049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.149414062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.149429083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.149477959 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.149497032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.149523973 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.149549961 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.150933027 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.150949955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.151001930 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.151015997 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.151041985 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.151057959 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.152682066 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.152698994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.152769089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.152791023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.152812958 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.152837038 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.153942108 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.153958082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.153999090 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.154035091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.154047966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.154103041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.157522917 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.157540083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.157588959 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.157640934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.157675028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.157697916 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.158257961 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.158322096 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.204988956 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.205073118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.205140114 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.205185890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.205207109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.205255985 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.205260038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.205272913 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.205323935 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.206228018 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.206243038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.206280947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.206321955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.206444979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.206463099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.206491947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.206545115 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.206588984 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.206669092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.206686020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.206758022 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.214950085 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.214997053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.215056896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.215169907 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.216780901 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.216797113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.216857910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.216895103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.217037916 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.217055082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.217127085 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.217140913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.217206001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.217250109 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.222609997 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.222635984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.222672939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.222806931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.223472118 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.223484039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.223525047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.223561049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.223668098 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.223683119 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.223817110 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.223835945 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.223871946 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.223918915 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.224025965 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.224046946 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.224240065 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.224265099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.224311113 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.224330902 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.224354982 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.224380016 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.225363970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.225383997 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.225461006 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.225476980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.225529909 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.226073027 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.226250887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.226267099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.226325035 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.226344109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.226366997 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.226396084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.226953983 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.227176905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.227193117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.227248907 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.227272987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.227308989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.227329016 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.227952003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.227968931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.228040934 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.228059053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.228086948 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.228107929 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.228813887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.228828907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.228880882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.228903055 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.228930950 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.228951931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.229751110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.229767084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.229815006 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.229840040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.229865074 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.229882956 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.230686903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.230709076 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.230757952 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.230776072 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.230808020 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.230829000 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.231724977 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.231739998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.231811047 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.231829882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.231878996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.232278109 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.232414961 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.232429981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.232491016 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.232506990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.232537031 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.232557058 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.232731104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.233305931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.233321905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.233392954 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.233408928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.233462095 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.233656883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.234344006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.234359026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.234441042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.234456062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.234510899 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.235357046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.235372066 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.235450983 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.235464096 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.235517025 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.236378908 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.236396074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.236454010 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.236471891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.236505985 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.236529112 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.237607956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.237627983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.237687111 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.237695932 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.237737894 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.238595009 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.238624096 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.238677025 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.238691092 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.238785982 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.238802910 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.240078926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.240097046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.240147114 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.240156889 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.240185022 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.240194082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.241194963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.241213083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.241270065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.241278887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.241316080 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.242010117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.242026091 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.242094994 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.242101908 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.242150068 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.242814064 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.242835999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.242882013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.242892027 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.242908955 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.242930889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.243638039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.243654966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.243716955 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.243732929 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.243776083 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.246231079 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.246249914 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.246320009 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.246347904 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.246364117 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.246397018 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.247287989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.247306108 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.247368097 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.247381926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.247422934 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.248855114 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.248874903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.248946905 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.248971939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.249022007 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.249937057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.249953985 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.250025034 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.250036001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.250078917 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.251614094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.251631021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.251709938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.251722097 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.251768112 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.252810001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.252826929 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.252886057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.252912045 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.252929926 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.252959013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.253925085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.253942966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.253999949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.254019022 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.254061937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.255141020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.255157948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.255238056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.255250931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.255297899 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.256213903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.256243944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.256310940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.256321907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.256354094 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.256366968 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.258189917 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.258209944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.258285046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.258297920 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.258347988 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.259838104 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.259857893 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.259932995 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.259948015 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.260011911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.261251926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.261269093 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.261343956 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.261358023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.261415005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.262363911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.262379885 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.262447119 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.262464046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.262512922 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.263681889 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.263705015 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.263751984 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.263775110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.263802052 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.263823986 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.264770985 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.264790058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.264858961 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.264877081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.264904976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.264925957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.265609980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.265626907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.265692949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.265711069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.265764952 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.266331911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.266349077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.266407967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.266422033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.266449928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.266474962 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.267226934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.267245054 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.267294884 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.267312050 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.267344952 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.267369986 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.267985106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.268001080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.268058062 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.268071890 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.268126965 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.269402981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.269422054 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.269483089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.269504070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.269526958 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.269550085 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.271481991 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.271507025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.271569014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.271591902 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.271621943 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.271641016 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.272757053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.272783995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.272834063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.272847891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.272872925 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.272895098 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.273794889 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.273811102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.273881912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.273896933 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.273947954 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.276638031 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.276659966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.276740074 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.276755095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.276809931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.277425051 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.277441025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.277502060 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.277520895 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.277551889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.277571917 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.278112888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.278129101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.278181076 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.278199911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.278222084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.278251886 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.278878927 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.278898001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.278944016 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.278963089 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.279037952 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.279067039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.279663086 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.279679060 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.279730082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.279748917 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.279772043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.279808044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.280359030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.280375957 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.280431986 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.280446053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.280497074 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.281228065 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.281244040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.281287909 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.281311035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.281337976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.281363964 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.281913996 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.281933069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.281987906 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.282004118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.282031059 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.282052994 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.282746077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.282763004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.282814026 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.282835960 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.282857895 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.282883883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.283497095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.283514977 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.283557892 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.283571005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.283598900 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.283618927 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.284264088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.284281015 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.284323931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.284337997 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.284363985 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.284382105 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.285056114 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.285075903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.285124063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.285145044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.285168886 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.285192013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.285686016 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.285701990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.285759926 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.285784006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.285806894 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.285830021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.286211014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.286227942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.286304951 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.286318064 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.286370993 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.286427021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.286447048 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.286499023 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.286516905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.286539078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.286575079 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.286765099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.286783934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.286844015 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.286858082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.286901951 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.287100077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.287122011 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.287156105 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.287156105 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.287173033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.287199974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.287218094 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.287410021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.287425995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.287502050 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.287502050 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.287514925 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.287564993 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.287817001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.287834883 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.287898064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.287909985 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.287935019 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.287965059 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.288153887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.288172007 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.288259983 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.288259983 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.288275957 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.288333893 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.288515091 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.288535118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.288592100 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.288603067 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.288626909 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.288664103 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.288842916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.288860083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.288908005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.288914919 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.288938046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.288957119 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.289164066 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.289181948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.289222002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.289228916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.289243937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.289264917 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.289521933 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.289539099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.289587021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.289594889 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.289609909 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.289637089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.292843103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.292874098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.292913914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.292938948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.292954922 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.292973042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.297240973 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.297256947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.297301054 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.297312021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.297334909 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.297346115 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.297939062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.297957897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.297992945 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.298007011 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.298021078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.298042059 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.298465967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.298480034 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.298517942 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.298527956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.298541069 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.298569918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.299055099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.299071074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.299115896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.299134970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.299176931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.299204111 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.299803972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.299818039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.299856901 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.299871922 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.299896955 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.299913883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.300131083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.300153017 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.300193071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.300214052 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.300259113 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.300275087 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.300889969 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.300904989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.300968885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.300985098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.301028013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.301291943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.301309109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.301346064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.301362991 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.301390886 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.301409006 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.302144051 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.302160025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.302198887 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.302212954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.302238941 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.302263021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.302624941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.302640915 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.302679062 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.302690983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.302715063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.302735090 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.303086042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.303100109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.303138018 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.303150892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.303174019 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.303195000 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.303409100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.303423882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.303482056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.303499937 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.303520918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.303540945 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.303777933 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.303792000 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.303832054 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.303844929 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.303868055 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.303889036 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.304127932 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.304142952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.304186106 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.304203987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.304253101 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.304253101 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.304573059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.304589033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.304630041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.304641962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.304668903 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.304688931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.304980993 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.304999113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.305042028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.305052996 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.305083036 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.305099010 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.305450916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.305464983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.305504084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.305516005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.305541039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.305558920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.305752993 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.305767059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.305802107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.305813074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.305836916 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.305870056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.306121111 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.306134939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.306191921 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.306202888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.306227922 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.306241989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.306476116 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.306492090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.306543112 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.306555033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.306581020 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.306598902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.306884050 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.306910038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.306938887 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.306971073 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.306998014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.307013988 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.307311058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.307326078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.307367086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.307379007 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.307401896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.307416916 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.307771921 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.307785988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.307825089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.307835102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.307857990 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.307878971 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.307996988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.308011055 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.308047056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.308058023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.308079958 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.308114052 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.308207035 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.308337927 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.308353901 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.308398008 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.308410883 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.308437109 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.308453083 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.308605909 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.308789015 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.308805943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.308851957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.308866978 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.308892965 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.308914900 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.309293985 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.309300900 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.309322119 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.309351921 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.309360027 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.309385061 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.309401035 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.309576035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.309592009 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.309633017 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.309642076 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.309659004 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.309678078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.309916973 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.309931993 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.309971094 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.309978962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.309999943 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.310013056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.310460091 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.310473919 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.310513020 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.310525894 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.310544014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.310564995 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.310792923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.310807943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.310848951 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.310857058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.310870886 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.310894012 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.311259031 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.311274052 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.311309099 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.311317921 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.311335087 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.311351061 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.311574936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.311588049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.311623096 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.311629057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.311649084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.311664104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.312096119 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.312110901 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.312151909 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.312159061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.312179089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.312191963 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.312442064 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.312458992 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.312506914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.312515020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.312527895 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.312556028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.312901020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.312921047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.312988997 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.312995911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.313030005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.313030005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.313359976 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.313374043 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.313417912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.313425064 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.313451052 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.313463926 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.313832998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.313853025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.313894033 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.313899994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.313925028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.313935995 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.314202070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.314218044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.314261913 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.314268112 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.314296007 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.314326048 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.314546108 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.314565897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.314603090 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.314610004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.314634085 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.314654112 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.314901114 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.314915895 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.314960003 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.314966917 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.314980984 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.315006971 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.315291882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.315306902 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.315342903 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.315350056 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.315367937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.315659046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.315680981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.315699100 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.315706015 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.315718889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.315741062 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.315761089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.316015005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.316030979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.316070080 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.316077948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.316092014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.316117048 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.316397905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.316432953 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.316454887 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.316462994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.316476107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.316505909 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.316714048 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.316734076 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.316768885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.316776037 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.316793919 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.316905022 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.317140102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.317157030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.317198038 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.317204952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.317234039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.317243099 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.317583084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.317600012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.317636013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.317643881 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.317658901 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.317684889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.317923069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.317939997 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.317972898 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.317981958 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.318000078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.318022013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.318324089 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.318341970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.318386078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.318392992 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.318406105 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.318433046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.318712950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.318734884 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.318773985 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.318783045 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.318809986 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.318826914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.319120884 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.319138050 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.319183111 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.319190979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.319242954 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.319271088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.319489956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.319508076 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.319555044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.319562912 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.319581032 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.319602966 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.319871902 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.319891930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.319924116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.319941044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.319956064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.319978952 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.320436001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.320452929 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.320497990 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.320506096 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.320537090 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.320552111 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.320909023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.320930958 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.320971012 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.320980072 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.321010113 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.321022034 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.321284056 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.321299076 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.321345091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.321352959 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.321367979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.321393967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.321651936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.321666956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.321707964 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.321715117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.321743011 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.321753979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.322181940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.322201014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.322246075 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.322252989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.322268963 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.322295904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.322547913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.322561979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.322609901 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.322618008 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.322633028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.322658062 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.322952032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.322966099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.323015928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.323026896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.323041916 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.323071003 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.323343039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.323358059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.323407888 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.323419094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.323435068 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.323462009 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.323782921 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.323797941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.323847055 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.323854923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.323870897 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.323887110 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.324381113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.324394941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.324446917 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.324455976 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.324472904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.324497938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.324656010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.324673891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.324716091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.324723959 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.324738979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.324764013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.325059891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.325079918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.325129986 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.325139999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.325155973 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.325177908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.325464010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.325479984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.325530052 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.325537920 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.325552940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.325577021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.326265097 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.326280117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.326327085 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.326337099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.326360941 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.326373100 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.326611042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.326626062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.326678991 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.326688051 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.326703072 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.326730013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.327186108 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.327199936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.327249050 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.327261925 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.327276945 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.327303886 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.327756882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.327770948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.327820063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.327831984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.327848911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.327868938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.328299999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.328315020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.328371048 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.328389883 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.328430891 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.328738928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.328753948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.328809023 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.328833103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.328860044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.328890085 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.329097033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.329113007 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.329158068 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.329173088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.329199076 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.329220057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.329529047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.329545021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.329596043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.329610109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.329638004 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.329653978 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.329891920 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.329910040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.329960108 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.329977989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.330001116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.330032110 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.330208063 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.330223083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.330272913 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.330286980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.330313921 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.330329895 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.330513000 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.330528975 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.330590963 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.330609083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.330620050 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.330650091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.330828905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.330842972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.330888987 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.330895901 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.330921888 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.330931902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.331140041 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.331156015 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.331208944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.331222057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.331245899 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.331267118 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.331512928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.331532955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.331585884 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.331607103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.331629038 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.331646919 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.331861973 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.331878901 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.331926107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.331938028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.331962109 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.331983089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.332515001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.332531929 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.332597971 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.332612038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.332664967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.332834005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.332849026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.332906008 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.332922935 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.332945108 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.332973957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.333265066 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.333281040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.333338022 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.333349943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.333373070 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.333395004 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.333626032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.333643913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.333689928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.333703041 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.333728075 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.333764076 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.334114075 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.334130049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.334173918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.334188938 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.334214926 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.334233999 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.334434032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.334450006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.334503889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.334522963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.334551096 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.334568024 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.335014105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.335027933 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.335083961 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.335104942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.335129023 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.335155010 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.335388899 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.335407019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.335453987 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.335464954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.335491896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.335511923 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.335912943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.335928917 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.335980892 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.335994005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.336019039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.336040974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.336298943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.336313963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.336365938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.336378098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.336402893 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.336424112 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.336684942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.336700916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.336755991 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.336767912 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.336791992 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.336811066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.337042093 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.337058067 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.337107897 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.337119102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.337146044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.337167025 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.337344885 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.337363005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.337408066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.337419987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.337444067 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.337460041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.337850094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.337872028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.337925911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.337940931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.337965012 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.337985992 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.338365078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.338382006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.338439941 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.338454008 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.338478088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.338499069 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.338716984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.338731050 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.338781118 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.338802099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.338825941 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.338841915 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.339080095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.339096069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.339152098 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.339164972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.339194059 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.339214087 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.339644909 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.339662075 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.339718103 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.339730978 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.339759111 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.339793921 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.339993000 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.340008974 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.340056896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.340068102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.340092897 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.340115070 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.340472937 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.340487957 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.340534925 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.340547085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.340572119 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.340590954 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.340862989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.340877056 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.340928078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.340939999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.340965986 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.340991020 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.341375113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.341391087 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.341442108 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.341454983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.341480970 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.341496944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.341793060 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.341806889 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.341862917 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.341881990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.341909885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.341934919 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.342235088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.342250109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.342294931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.342314005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.342339039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.342358112 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.342698097 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.342714071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.342756987 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.342771053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.342796087 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.342817068 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.343049049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.343065023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.343107939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.343120098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.343146086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.343166113 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.343396902 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.343410969 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.343452930 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.343465090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.343489885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.343508959 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.343836069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.343851089 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.343894005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.343911886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.343935013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.343955994 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.344139099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.344189882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.344203949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.344245911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.344279051 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.344299078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.344530106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.344544888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.344585896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.344599009 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.344625950 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.344641924 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.345002890 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.345016956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.345062971 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.345077038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.345103979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.345124006 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.345540047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.345554113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.345606089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.345621109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.345649004 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.345674992 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.346020937 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.346035957 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.346086979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.346100092 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.346122980 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.346143961 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.346477032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.346492052 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.346540928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.346554041 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.346580982 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.346596956 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.346889973 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.346904993 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.346947908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.346960068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.347014904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.347014904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.347388029 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.347402096 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.347450018 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.347461939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.347486973 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.347502947 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.347707987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.347723961 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.347774982 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.347789049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.347812891 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.347832918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.348764896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.348778963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.348834991 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.348845005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.348865986 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.348879099 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.349319935 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.349334002 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.349379063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.349389076 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.349430084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.349452019 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.350040913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.350056887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.350127935 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.350140095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.350184917 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.350414991 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.350430012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.350474119 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.350481987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.350496054 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.350526094 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.350900888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.350917101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.350963116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.350970030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.350997925 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.351008892 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.351289988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.351305962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.351351976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.351357937 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.351385117 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.351394892 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.351717949 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.351737976 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.351787090 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.351795912 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.351814032 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.351825953 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.352093935 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.352112055 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.352174997 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.352183104 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.352233887 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.352658033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.352710009 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.352741957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.352749109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.352781057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.352793932 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.352993965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.353013039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.353055954 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.353063107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.353085041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.353096962 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.353319883 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.353333950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.353374958 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.353382111 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.353414059 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.353423119 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.353785992 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.353805065 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.353843927 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.353851080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.353879929 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.353890896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.354145050 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.354160070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.354208946 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.354216099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.354233027 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.354259014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.354460955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.354475975 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.354518890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.354526997 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.354552031 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.354561090 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.354852915 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.354867935 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.354913950 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.354923010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.354948044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.354958057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.355206013 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.355221033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.355263948 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.355272055 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.355292082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.355303049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.355572939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.355588913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.355637074 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.355647087 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.355670929 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.355679035 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.355839968 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.355886936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.355890989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.355900049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.355938911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.356151104 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.356165886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.356209040 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.356226921 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.356236935 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.356266022 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.356509924 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.356524944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.356565952 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.356575012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.356597900 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.356611967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.357780933 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.357798100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.357858896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.357868910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.357882977 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.357908010 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.358414888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.358434916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.358479977 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.358489037 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.358504057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.358525991 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.359143972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.359160900 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.359210014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.359216928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.359241962 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.359261990 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.359755039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.359772921 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.359827042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.359833956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.359864950 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.360553026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.360574007 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.360595942 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.360603094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.360615969 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.360651016 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.360913038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.360927105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.360977888 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.360985994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.360997915 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.361026049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.361248970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.361264944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.361310005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.361316919 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.361331940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.361354113 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.362399101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.362415075 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.362474918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.362483025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.362495899 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.362524033 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.363639116 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.363655090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.363707066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.363718987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.363739967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.363756895 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.364099026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.364114046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.364152908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.364162922 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.364188910 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.364202976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.364748001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.364763975 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.364814043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.364824057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.364849091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.364865065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.365129948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.365144968 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.365183115 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.365191936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.365207911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.365226984 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.365564108 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.365581989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.365616083 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.365622997 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.365644932 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.365658998 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.365962029 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.365978003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.366020918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.366028070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.366050005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.366067886 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.366349936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.366364956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.366400003 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.366409063 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.366434097 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.366449118 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.366734028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.366749048 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.366786957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.366797924 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.366821051 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.366848946 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.367192984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.367212057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.367259026 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.367266893 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.367288113 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.367301941 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.367647886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.367664099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.367714882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.367723942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.367738962 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.367763996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.368037939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.368058920 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.368105888 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.368113041 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.368127108 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.368156910 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.368495941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.368513107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.368558884 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.368566990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.368596077 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.368608952 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.368891954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.368907928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.368957996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.368963957 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.368990898 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.369000912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.369281054 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.369296074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.369353056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.369360924 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.369402885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.369642019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.369658947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.369699955 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.369707108 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.369733095 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.369751930 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.370052099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.370071888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.370117903 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.370124102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.370148897 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.370162010 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.370390892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.370407104 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.370450974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.370457888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.370469093 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.370492935 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.370764017 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.370810032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.370824099 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.370830059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.370855093 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.370872974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.371249914 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.371267080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.371309042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.371315002 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.371332884 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.371351957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.373023033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.373043060 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.373128891 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.373141050 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.373187065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.374111891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.374130964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.374176025 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.374182940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.374196053 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.374223948 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.375710011 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.375730038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.375772953 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.375778913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.375792027 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.375823021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.376281977 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.376298904 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.376339912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.376347065 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.376359940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.376391888 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.376801014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.376820087 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.376856089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.376863003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.376889944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.376899958 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.377408028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.377425909 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.377463102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.377469063 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.377490997 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.377511024 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.377983093 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.378002882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.378036976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.378045082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.378067017 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.378084898 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.378386021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.378401995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.378432989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.378439903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.378463984 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.378482103 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.378762007 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.378782988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.378809929 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.378818035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.378838062 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.378856897 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.379141092 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.379158020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.379195929 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.379203081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.379225969 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.379242897 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.379457951 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.379502058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.379534006 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.379539967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.379565001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.379580975 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.379785061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.379801035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.379836082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.379841089 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.379867077 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.379880905 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.380116940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.380132914 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.380167007 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.380172968 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.380193949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.380209923 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.380503893 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.380518913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.380554914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.380561113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.380584955 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.380600929 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.380815029 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.380829096 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.380867958 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.380873919 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.380897045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.380914927 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.381103992 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.381122112 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.381156921 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.381162882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.381184101 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.381201029 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.381460905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.381477118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.381515980 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.381521940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.381545067 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.381561995 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.381886005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.381901026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.381944895 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.381953001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.381967068 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.381997108 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.382198095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.382214069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.382260084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.382266998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.382281065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.382306099 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.382534981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.382563114 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.382607937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.382613897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.382631063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.382654905 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.383060932 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.383078098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.383117914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.383124113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.383145094 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.383164883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.383203983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.383220911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.383265018 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.383271933 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.383297920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.383310080 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.383594036 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.383610964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.383651018 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.383660078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.383671045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.383687973 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.383707047 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.384012938 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.384028912 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.384078979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.384085894 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.384099960 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.384126902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.384421110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.384437084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.384480953 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.384488106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.384502888 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.384531021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.384608030 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.384974003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.384989977 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.385035038 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.385041952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.385056019 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.385081053 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.385365963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.385380983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.385421038 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.385427952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.385445118 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.385466099 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.386162996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.386410952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.386425018 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.386464119 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.386471033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.386496067 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.386514902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.386534929 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.386981964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.387002945 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.387042046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.387048960 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.387073994 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.387085915 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.387825012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.387841940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.387902975 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.387909889 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.387955904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.388175964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.388194084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.388235092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.388243914 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.388272047 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.388288021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.388617039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.388633013 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.388675928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.388683081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.388712883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.388712883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.389554024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.389575958 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.389619112 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.389626980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.389656067 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.389672995 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.390132904 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.390149117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.390194893 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.390204906 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.390228987 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.390249014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.390567064 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.390585899 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.390630007 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.390638113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.390657902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.390678883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.391170025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.391186953 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.391235113 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.391244888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.391264915 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.391294003 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.391509056 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.391526937 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.391607046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.391607046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.391616106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.391660929 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.392115116 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.392132998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.392179966 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.392187119 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.392235041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.392235041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.392638922 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.392654896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.392703056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.392709970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.392738104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.392757893 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.393107891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.393122911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.393172979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.393179893 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.393203974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.393224001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.393590927 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.393609047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.393649101 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.393656015 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.393681049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.393697023 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.394105911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.394121885 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.394175053 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.394186020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.394208908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.394223928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.394648075 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.394663095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.394715071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.394726038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.394762993 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.395181894 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.395196915 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.395246029 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.395256042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.395277023 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.395293951 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.395766020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.395781994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.395842075 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.395852089 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.395867109 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.395894051 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.396163940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.396181107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.396234989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.396245003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.396255970 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.396289110 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.396609068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.396626949 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.396667957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.396675110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.396703959 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.396713972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.397099972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.397115946 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.397178888 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.397186995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.397228003 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.397536039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.397552967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.397600889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.397607088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.397634029 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.397654057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.398062944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.398078918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.398124933 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.398132086 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.398156881 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.398175001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.398545980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.398562908 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.398614883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.398622036 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.398650885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.398660898 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.399020910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.399044037 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.399086952 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.399096012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.399122953 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.399142027 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.399463892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.399481058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.399552107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.399559975 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.399626017 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.400017023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.400033951 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.400075912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.400083065 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.400099993 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.400122881 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.400439024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.400453091 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.400506973 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.400515079 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.400541067 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.400553942 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.400964975 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.400980949 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.401021957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.401029110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.401055098 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.401065111 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.401494026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.401509047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.401566029 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.401572943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.401587009 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.401607990 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.402046919 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.402061939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.402132034 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.402138948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.402182102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.402601004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.402616024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.402668953 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.402674913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.402693033 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.402712107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.403079033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.403095007 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.403157949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.403165102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.403201103 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.403513908 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.403529882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.403583050 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.403589964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.403605938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.403630972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.404022932 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.404042006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.404099941 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.404108047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.404120922 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.404140949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.404524088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.404540062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.404589891 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.404597044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.404612064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.404633045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.405009985 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.405026913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.405086994 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.405092955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.405134916 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.405541897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.405559063 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.405607939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.405622005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.405636072 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.405662060 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.406013966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.406029940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.406088114 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.406095028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.406132936 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.406292915 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.406318903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.406344891 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.406354904 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.406387091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.406387091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.406793118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.406810045 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.406853914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.406861067 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.406886101 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.406893969 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.407320023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.407336950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.407387972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.407403946 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.407440901 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.407762051 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.407778978 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.407834053 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.407840967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.407857895 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.407879114 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.408189058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.408206940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.408267021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.408273935 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.408320904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.409085035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.409100056 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.409143925 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.409152031 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.409171104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.409193039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.409365892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.409382105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.409425974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.409434080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.409459114 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.409468889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.409794092 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.409807920 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.409858942 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.409864902 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.409879923 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.409903049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.410259962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.410275936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.410329103 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.410336018 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.410347939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.410372972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.410756111 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.410770893 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.410830975 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.410837889 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.410880089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.411370039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.411386967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.411443949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.411449909 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.411490917 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.411782980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.411798954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.411849022 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.411859989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.411880016 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.411892891 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.412200928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.412223101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.412265062 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.412271023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.412297010 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.412306070 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.412744999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.412764072 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.412821054 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.412831068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.412869930 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.413279057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.413295984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.413341999 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.413348913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.413363934 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.413383961 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.413634062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.413649082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.413696051 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.413702965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.413717985 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.413744926 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.414146900 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.414164066 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.414222956 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.414230108 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.414269924 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.414741039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.414757013 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.414813042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.414819002 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.414859056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.415272951 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.415287971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.415338039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.415344000 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.415357113 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.415381908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.415735960 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.415751934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.415802002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.415807962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.415826082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.415843964 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.416186094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.416203022 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.416258097 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.416265011 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.416300058 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.416806936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.416822910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.416872978 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.416879892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.416893005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.416914940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.417254925 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.417269945 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.417316914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.417325974 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.417340040 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.417365074 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.417768955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.417792082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.417839050 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.417845964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.417859077 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.417886972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.418188095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.418204069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.418258905 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.418267012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.418308020 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.418746948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.418764114 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.418823004 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.418829918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.418868065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.419308901 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.419326067 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.419377089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.419385910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.419426918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.419774055 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.419789076 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.419831991 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.419837952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.419859886 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.419878006 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.420236111 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.420255899 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.420300961 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.420314074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.420350075 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.420665979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.420681000 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.420733929 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.420742035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.420775890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.421241999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.421257019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.421304941 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.421313047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.421328068 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.421344042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.421611071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.421624899 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.421664953 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.421674013 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.421696901 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.421708107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.422014952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.422032118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.422075987 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.422084093 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.422106028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.422122002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.422558069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.422573090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.422626019 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.422635078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.422671080 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.422951937 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.422966003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.423008919 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.423017979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.423032045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.423054934 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.423454046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.423470020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.423521042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.423532963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.423571110 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.423918009 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.423933029 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.423985004 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.423995972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.424034119 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.424417019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.424432039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.424480915 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.424489021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.424530983 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.424998999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.425013065 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.425057888 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.425070047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.425084114 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.425107002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.425347090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.425364971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.425411940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.425421000 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.425435066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.425451040 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.425843954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.425862074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.425909996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.425916910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.425932884 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.425951958 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.426306009 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.426352024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.426377058 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.426383972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.426402092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.426418066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.426702976 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.426717997 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.426769018 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.426783085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.426819086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.427304983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.427328110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.427386999 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.427396059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.427436113 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.427855015 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.427870035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.427928925 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.427937031 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.427958012 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.427968979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.428328991 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.428344011 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.428395987 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.428406000 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.428445101 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.428778887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.428792953 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.428839922 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.428847075 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.428863049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.428886890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.429241896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.429258108 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.429310083 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.429317951 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.429357052 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.429769993 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.429785967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.429827929 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.429836988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.429852009 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.429872990 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.430205107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.430222034 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.430272102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.430280924 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.430315971 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.430908918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.430923939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.430967093 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.430978060 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.430994034 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.431016922 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.431202888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.431216955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.431265116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.431272030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.431287050 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.431299925 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.431627989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.431659937 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.431691885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.431701899 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.431716919 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.431731939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.432113886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.432130098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.432172060 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.432179928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.432199001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.432225943 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.432555914 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.432569981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.432612896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.432622910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.432636976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.432658911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.433049917 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.433068037 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.433119059 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.433126926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.433162928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.433552980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.433568001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.433619976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.433626890 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.433664083 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.434093952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.434108973 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.434150934 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.434159040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.434171915 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.434194088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.434397936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.434416056 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.434461117 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.434468985 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.434484959 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.434499025 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.434792995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.434808016 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.434851885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.434859037 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.434873104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.434894085 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.435168982 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.435184956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.435235977 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.435244083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.435278893 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.435658932 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.435674906 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.435722113 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.435730934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.435765982 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.436146975 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.436161041 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.436206102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.436214924 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.436258078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.436496973 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.436510086 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.436557055 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.436566114 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.436582088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.436595917 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.436989069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.437002897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.437053919 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.437061071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.437100887 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.437457085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.437474012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.437516928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.437524080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.437539101 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.437560081 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.437983990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.437998056 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.438041925 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.438051939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.438066006 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.438087940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.438447952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.438462019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.438507080 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.438515902 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.438534021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.438546896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.438885927 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.438899994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.438950062 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.438958883 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.438971043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.438992977 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.439409971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.439424992 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.439474106 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.439481974 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.439522028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.439961910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.439975977 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.440020084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.440026999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.440045118 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.440061092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.440388918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.440404892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.440443993 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.440453053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.440469027 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.440483093 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.440897942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.440912008 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.440963030 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.440970898 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.441009998 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.441286087 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.441302061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.441340923 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.441349983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.441366911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.441386938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.441694021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.441709042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.441755056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.441764116 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.441798925 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.441930056 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.441942930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.441986084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.441993952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.442007065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.442028046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.442851067 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.442864895 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.442917109 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.442929029 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.442949057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.442962885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.443262100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.443276882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.443319082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.443326950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.443353891 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.443540096 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.443559885 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.443574905 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.443582058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.443595886 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.443625927 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.443985939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.444000006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.444042921 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.444048882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.444072008 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.444089890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.444350004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.444365025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.444403887 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.444411993 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.444426060 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.444447994 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.444725990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.444741011 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.444777012 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.444785118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.444808006 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.444819927 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.445414066 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.445430040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.445487976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.445497036 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.445533037 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.445725918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.445741892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.445789099 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.445795059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.445812941 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.445827007 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.446218967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.446234941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.446296930 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.446304083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.446341038 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.446475029 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.446490049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.446526051 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.446532965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.446552038 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.446566105 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.446903944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.446922064 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.446964979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.446971893 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.446996927 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.447010040 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.447552919 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.447567940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.447623968 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.447633028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.447671890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.447901011 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.447920084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.447962999 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.447969913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.447989941 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.448007107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.448210001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.448230028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.448270082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.448282957 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.448324919 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.448535919 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.448551893 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.448602915 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.448611021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.448647022 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.448977947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.448993921 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.449038982 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.449045897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.449068069 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.449079990 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.449301004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.449316978 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.449358940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.449367046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.449388027 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.449402094 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.449609995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.449624062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.449665070 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.449675083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.449743032 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.449743032 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.449773073 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.450048923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.450064898 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.450117111 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.450125933 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.450165033 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.450462103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.450478077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.450520992 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.450530052 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.450545073 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.450568914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.450870037 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.450886011 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.450938940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.450948000 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.450962067 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.450984001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.451344967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.451360941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.451411009 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.451420069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.451459885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.451842070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.451858044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.451906919 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.451914072 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.451948881 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.452373028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.452388048 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.452449083 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.452457905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.452497959 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.453005075 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.453020096 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.453068972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.453078032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.453115940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.453388929 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.453406096 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.453449011 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.453457117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.453476906 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.453493118 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.453892946 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.453907967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.453962088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.453969955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.454008102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.454458952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.454478979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.454531908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.454544067 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.454580069 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.454854965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.454869986 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.454922915 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.454931021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.454967022 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.455487967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.455502987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.455558062 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.455568075 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.455602884 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.456048012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.456063986 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.456114054 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.456123114 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.456159115 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.456444979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.456461906 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.456507921 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.456516027 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.456548929 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.456954002 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.456969023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.457007885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.457019091 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.457036972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.457051039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.457436085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.457452059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.457503080 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.457511902 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.457549095 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.457931042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.457946062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.457998037 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.458005905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.458044052 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.458316088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.458333015 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.458384991 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.458393097 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.458429098 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.458574057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.458589077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.458632946 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.458641052 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.458678961 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.458888054 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.458903074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.458945990 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.458952904 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.458970070 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.458993912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.459249973 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.459266901 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.459310055 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.459317923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.459332943 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.459352970 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.459630013 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.459645987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.459697008 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.459702969 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.459830999 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.459934950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.459949970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.459994078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.460001945 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.460036039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.460315943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.460333109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.460378885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.460386992 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.460400105 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.460419893 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.460635900 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.460659027 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.460700989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.460711956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.460724115 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.460752010 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.461034060 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.461050987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.461097002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.461106062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.461138964 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.461426020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.461441040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.461484909 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.461491108 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.461512089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.461528063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.461812973 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.461827993 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.461868048 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.461874962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.461896896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.461913109 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.462187052 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.462203979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.462256908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.462263107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.462296009 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.462702990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.462718010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.462801933 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.462809086 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.462846041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.463148117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.463165998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.463206053 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.463213921 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.463232994 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.463249922 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.463704109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.463718891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.463769913 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.463777065 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.463813066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.464013100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.464029074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.464076996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.464085102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.464118958 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.464535952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.464550972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.464601994 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.464611053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.464647055 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.465080976 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.465095997 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.465141058 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.465148926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.465166092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.465183020 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.465605021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.465619087 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.465677023 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.465688944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.465724945 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.466213942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.466229916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.466284990 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.466295004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.466340065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.466727018 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.466742039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.466794014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.466804028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.466840029 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.467299938 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.467315912 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.467367887 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.467379093 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.467395067 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.467417002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.467813015 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.467832088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.467885017 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.467899084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.467935085 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.468389988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.468405008 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.468452930 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.468462944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.468485117 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.468496084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.468748093 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.468761921 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.468812943 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.468823910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.468859911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.469320059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.469335079 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.469386101 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.469398975 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.469434977 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.469754934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.469789028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.469827890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.469839096 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.469855070 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.469871044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.470236063 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.470249891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.470305920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.470318079 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.470355034 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.470736980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.470756054 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.470807076 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.470819950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.470858097 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.471183062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.471198082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.471252918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.471261978 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.471295118 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.471645117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.471659899 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.471707106 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.471726894 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.471749067 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.471764088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.471925974 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.471942902 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.471985102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.471995115 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.472038031 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.472429991 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.472446918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.472498894 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.472508907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.472543001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.473057032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.473073006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.473124981 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.473136902 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.473172903 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.475097895 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.475114107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.475188017 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.475207090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.475244999 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.477283955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.477299929 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.477363110 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.477384090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.477420092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.478724957 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.478741884 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.478801966 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.478816986 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.478854895 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.480233908 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.480254889 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.480315924 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.480330944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.480369091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.481667042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.481714964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.481743097 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.481770992 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.481790066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.481812954 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.483197927 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.483213902 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.483273029 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.483297110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.483338118 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.484647989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.484663963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.484709024 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.484730005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.484745979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.484826088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.485090971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.485109091 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.485147953 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.485157013 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.485174894 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.485199928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.485642910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.485661983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.485704899 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.485714912 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.485758066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.486052990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.486073971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.486120939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.486129045 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.486179113 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.486608028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.486627102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.486679077 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.486690044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.486735106 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.486974955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.486993074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.487034082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.487041950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.487066031 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.487082005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.487365007 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.487380981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.487428904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.487437010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.487479925 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.487848997 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.487864971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.487919092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.487929106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.487971067 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.488262892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.488281965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.488332033 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.488338947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.488382101 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.488928080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.488948107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.488996983 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.489008904 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.489049911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.489475965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.489500999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.489535093 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.489545107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.489567995 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.489583969 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.489794016 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.489810944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.489856958 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.489866018 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.489892006 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.489911079 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.490607023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.490639925 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.490681887 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.490693092 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.490732908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.490890026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.490906000 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.490943909 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.490952015 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.490986109 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.490986109 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.491414070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.491427898 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.491478920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.491489887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.491529942 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.491839886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.491856098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.491905928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.491915941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.491955996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.492314100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.492331028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.492372036 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.492386103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.492402077 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.492422104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.492798090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.492813110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.492866039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.492882967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.492896080 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.492930889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.493288994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.493304014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.493349075 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.493360043 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.493375063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.493390083 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.493789911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.493805885 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.493849039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.493860006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.493875027 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.493895054 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.494330883 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.494344950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.494390011 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.494400024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.494415045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.494432926 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.494652987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.494668007 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.494716883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.494724989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.494755983 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.495100021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.495114088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.495158911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.495167971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.495182037 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.495203018 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.495714903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.495731115 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.495784998 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.495795965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.495830059 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.496191978 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.496206045 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.496247053 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.496258020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.496273041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.496289015 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.496618986 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.496653080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.496680021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.496689081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.496702909 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.496723890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.497101068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.497114897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.497168064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.497179031 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.497211933 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.497605085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.497627020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.497675896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.497688055 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.497723103 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.498123884 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.498137951 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.498187065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.498198032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.498231888 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.498626947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.498641014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.498684883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.498696089 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.498712063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.498729944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.499118090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.499130964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.499171972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.499181986 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.499197006 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.499217033 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.499607086 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.499622107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.499674082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.499686003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.499721050 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.500056982 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.500072002 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.500122070 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.500129938 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.500165939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.500593901 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.500612974 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.500662088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.500670910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.500706911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.501111984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.501127005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.501172066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.501180887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.501193047 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.501211882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.501542091 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.501560926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.501597881 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.501607895 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.501621962 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.501641035 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.501983881 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.501998901 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.502052069 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.502065897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.502077103 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.502099037 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.502474070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.502489090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.502546072 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.502552986 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.502594948 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.503057003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.503071070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.503123999 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.503134012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.503154039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.503171921 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.503412962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.503427982 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.503473043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.503480911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.503493071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.503513098 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.503860950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.503875971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.503926992 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.503935099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.503950119 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.503976107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.504251957 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.504266977 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.504317045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.504326105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.504359961 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.504745960 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.504765034 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.504811049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.504825115 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.504859924 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.505214930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.505229950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.505276918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.505287886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.505302906 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.505321026 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.505669117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.505682945 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.505743980 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.505753994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.505789995 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.506220102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.506233931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.506294012 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.506304979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.506339073 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.506603003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.506618023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.506668091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.506679058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.506920099 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.507234097 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.507275105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.507304907 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.507317066 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.507333040 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.507353067 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.507740021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.507755995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.507858038 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.507869959 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.507908106 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.508208990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.508229017 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.508277893 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.508289099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.508302927 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.508322954 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.508737087 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.508752108 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.508806944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.508819103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.508852959 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.509212971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.509229898 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.509279966 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.509290934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.509325981 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.509685040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.509701014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.509754896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.509763956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.509799004 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.510190964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.510206938 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.510256052 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.510268927 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.510292053 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.510309935 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.510601044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.510622025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.510668993 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.510682106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.510696888 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.510718107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.511038065 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.511053085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.511089087 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.511101007 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.511115074 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.511137009 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.511641979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.511655092 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.511703014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.511713982 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.511734962 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.511750937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.512192965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.512212992 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.512254953 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.512265921 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.512281895 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.512301922 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.512779951 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.512795925 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.512844086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.512852907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.512887955 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.513034105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.513048887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.513082027 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.513088942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.513108969 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.513127089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.513303041 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.513319969 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.513358116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.513365984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.513382912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.513401031 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.513768911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.513783932 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.513849020 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.513860941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.513895035 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.514306068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.514321089 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.514374018 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.514384985 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.514419079 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.514863014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.514882088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.514940023 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.514951944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.514986038 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.515382051 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.515396118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.515455008 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.515466928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.515501022 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.515805006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.515821934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.515871048 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.515882969 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.515897989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.515923023 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.516277075 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.516293049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.516341925 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.516351938 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.516375065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.516391993 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.516685963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.516701937 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.516750097 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.516760111 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.516777039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.516796112 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.517162085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.517178059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.517231941 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.517241955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.517258883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.517277956 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.517637968 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.517654896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.517716885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.517735958 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.517771959 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.518209934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.518228054 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.518568993 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.518582106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.518619061 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.518682003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.518697977 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.518733025 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.518740892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.518758059 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.518774986 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.519188881 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.519207954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.519268036 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.519279003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.519318104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.519697905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.519714117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.519771099 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.519781113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.519815922 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.520145893 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.520163059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.520212889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.520231009 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.520250082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.520271063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.520761967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.520777941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.520823956 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.520833969 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.520848989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.520865917 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.521311998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.521327019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.521385908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.521395922 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.521431923 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.521629095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.521645069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.521703959 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.521713972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.521748066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.522207022 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.522222042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.522274017 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.522285938 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.522320032 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.522603989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.522619009 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.522660971 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.522671938 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.522686005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.522707939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.523199081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.523257971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.523266077 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.523276091 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.523298025 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.523309946 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.523750067 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.523765087 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.523801088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.523811102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.523828030 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.523848057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.524246931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.524262905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.524305105 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.524316072 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.524329901 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.524348974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.524642944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.524662971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.524718046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.524732113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.524743080 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.524771929 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.525155067 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.525170088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.525211096 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.525223017 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.525237083 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.525254965 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.525568962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.525587082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.525629044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.525640011 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.525655031 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.525676012 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.526040077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.526055098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.526098967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.526112080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.526125908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.526154041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.526525021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.526546001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.526581049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.526596069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.526612043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.526632071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.527041912 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.527056932 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.527091980 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.527105093 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.527117968 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.527137995 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.527573109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.527589083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.527637959 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.527647972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.527663946 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.527679920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.528070927 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.528085947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.528136969 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.528148890 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.528163910 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.528183937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.528470993 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.528498888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.528525114 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.528534889 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.528548956 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.528569937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.528989077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.529002905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.529050112 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.529062033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.529077053 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.529098988 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.529582024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.529617071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.529638052 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.529648066 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.529661894 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.529680967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.530078888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.530092955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.530128956 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.530141115 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.530159950 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.530178070 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.530666113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.530683041 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.530725002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.530736923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.530750990 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.530771017 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.531163931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.531177998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.531214952 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.531227112 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.531243086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.531267881 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.531512022 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.531526089 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.531569004 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.531579971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.531598091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.531616926 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.532191038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.532205105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.532246113 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.532259941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.532273054 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.532293081 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.532785892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.532800913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.532845974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.532855988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.532870054 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.532892942 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.533150911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.533164978 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.533204079 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.533212900 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.533230066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.533250093 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.533662081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.533677101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.533719063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.533729076 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.533744097 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.533766031 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.534270048 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.534286022 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.534323931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.534338951 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.534357071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.534379005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.534778118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.534795046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.534833908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.534845114 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.534857988 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.534879923 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.535221100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.535235882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.535278082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.535289049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.535301924 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.535317898 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.535873890 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.535888910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.535928965 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.535937071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.535953045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.535973072 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.536209106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.536227942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.536281109 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.536289930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.536309004 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.536328077 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.536818027 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.536834002 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.536870003 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.536880970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.536892891 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.536914110 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.537460089 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.537475109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.537512064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.537525892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.537540913 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.537559032 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.537921906 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.537936926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.537966967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.537980080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.537993908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.538017988 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.538248062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.538268089 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.538269997 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.538290024 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.538315058 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.538322926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.538356066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.538595915 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.538609982 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.538652897 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.538661957 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.538681030 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.538697958 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.538958073 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.539074898 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.539108038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.539129019 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.539139032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.539160967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.539176941 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.539463997 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.539499044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.539513111 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.539551020 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.539560080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.539582014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.539603949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.539935112 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.540138006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.540180922 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.540200949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.540210962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.540239096 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.540249109 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.540625095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.540640116 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.540690899 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.540704012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.540736914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.540765047 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.541325092 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.541349888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.541385889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.541397095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.541410923 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.541436911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.541711092 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.541733980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.541778088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.541786909 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.541826010 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.542220116 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.542237043 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.542284012 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.542292118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.542335987 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.542676926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.542692900 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.542733908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.542747974 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.542763948 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.542788029 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.543107033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.543124914 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.543169022 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.543179989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.543226957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.543565035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.543581963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.543622971 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.543631077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.543643951 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.543668032 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.543982029 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.543999910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.544043064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.544049025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.544090033 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.544471979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.544490099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.544533014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.544544935 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.544559956 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.544578075 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.544934988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.544956923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.544998884 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.545008898 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.545021057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.545043945 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.545506001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.545522928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.545573950 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.545593023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.545629025 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.545896053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.545912027 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.545964003 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.545974970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.546008110 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.546438932 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.546456099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.546495914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.546504974 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.546520948 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.546540022 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.546962023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.546979904 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.547032118 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.547041893 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.547072887 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.547524929 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.547544956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.547589064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.547599077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.547615051 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.547633886 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.547971964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.547990084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.548038006 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.548047066 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.548079967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.548542976 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.548558950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.548610926 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.548619986 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.548654079 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.549200058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.549222946 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.549261093 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.549272060 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.549284935 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.549304962 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.549556017 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.549582005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.549613953 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.549624920 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.549639940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.549659967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.550051928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.550070047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.550112009 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.550121069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.550133944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.550153971 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.550533056 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.550584078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.550628901 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.550637007 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.550652981 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.550666094 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.551212072 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.551230907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.551281929 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.551295042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.551326990 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.551872969 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.551892042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.551945925 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.551956892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.551997900 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.552439928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.552457094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.552515030 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.552526951 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.552561998 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.553045988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.553066015 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.553124905 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.553136110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.553169966 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.553236961 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.553251982 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.553282976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.553291082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.553304911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.553323984 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.553634882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.553651094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.553697109 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.553705931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.553740978 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.553906918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.553920984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.553955078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.553962946 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.553977966 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.553997993 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.554137945 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.554157972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.554193974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.554203033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.554224014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.554244995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.554244995 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.554256916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.554280996 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.554286957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.554310083 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.554315090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.554332972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.554383993 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.554759979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.554775000 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.554811001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.554816961 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.554842949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.554858923 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.555247068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.555264950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.555321932 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.555331945 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.555383921 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.555684090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.555704117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.555752039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.555764914 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.555778027 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.555808067 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.556201935 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.556225061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.556257010 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.556265116 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.556288004 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.556302071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.556572914 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.556588888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.556639910 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.556648016 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.556687117 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.556991100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.557008028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.557065010 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.557076931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.557111979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.557527065 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.557543993 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.557588100 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.557600021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.557635069 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.558303118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.558321953 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.558367014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.558383942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.558398008 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.558415890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.558681011 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.558697939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.558743000 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.558756113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.558787107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.559246063 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.559263945 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.559318066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.559326887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.559360981 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.559628010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.559645891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.559690952 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.559699059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.559712887 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.559732914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.560076952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.560092926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.560143948 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.560153961 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.560183048 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.560266018 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.560281038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.560318947 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.560328960 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.560342073 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.560362101 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.560563087 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.560606003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.560633898 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.560642004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.560659885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.560678005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.560933113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.560946941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.560993910 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.561002016 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.561032057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.561356068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.561369896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.561414003 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.561423063 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.561438084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.561458111 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.561754942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.561770916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.561820984 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.561830997 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.561865091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.562077999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.562098980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.562144995 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.562153101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.562187910 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.562439919 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.562453985 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.562499046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.562508106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.562522888 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.562542915 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.562814951 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.562830925 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.562882900 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.562891960 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.562923908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.563147068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.563162088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.563211918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.563220024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.563252926 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.563487053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.563500881 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.563551903 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.563560963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.563591957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.563886881 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.563900948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.563941956 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.563952923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.563966036 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.563986063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.564223051 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.564239025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.564290047 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.564300060 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.564333916 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.564573050 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.564588070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.564630985 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.564640045 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.564656973 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.564676046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.564945936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.564960957 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.565011978 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.565022945 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.565057993 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.565272093 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.565289021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.565324068 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.565332890 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.565351009 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.565370083 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.565685034 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.565699100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.565752983 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.565762043 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.565797091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.566015959 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.566030979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.566072941 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.566087961 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.566102982 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.566123009 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.566418886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.566432953 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.566481113 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.566489935 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.566526890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.566797018 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.566812038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.566855907 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.566865921 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.566878080 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.566900015 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.567186117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.567199945 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.567250967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.567260027 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.567297935 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.567801952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.567819118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.567879915 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.567889929 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.567933083 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.568223953 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.568239927 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.568294048 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.568301916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.568341017 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.568595886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.568608046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.568664074 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.568671942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.568711042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.568948030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.568963051 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.569015980 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.569024086 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.569060087 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.569277048 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.569292068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.569340944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.569348097 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.569364071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.569379091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.569673061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.569686890 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.569736004 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.569744110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.569762945 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.569782972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.570004940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.570019960 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.570060968 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.570070028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.570086002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.570107937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.570348024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.570363998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.570425987 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.570436001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.570475101 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.570918083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.570965052 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.571011066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.571018934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.571032047 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.571050882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.571300030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.571316004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.571366072 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.571372986 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.571407080 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.571602106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.571618080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.571660995 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.571666956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.571683884 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.571866035 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.571959019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.571974039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.572021008 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.572030067 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.572062969 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.572560072 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.572576046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.572626114 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.572639942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.572675943 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.572990894 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.573004961 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.573059082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.573071003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.573085070 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.573111057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.573601007 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.573616028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.573663950 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.573676109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.573713064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.574059010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.574076891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.574131012 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.574147940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.574183941 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.574490070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.574506044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.574558973 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.574569941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.574615955 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.574875116 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.574889898 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.574947119 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.574955940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.574994087 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.575347900 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.575361967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.575417995 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.575429916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.575465918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.575768948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.575784922 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.575839043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.575850010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.575886011 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.576191902 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.576208115 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.576261044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.576271057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.576283932 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.576307058 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.576525927 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.576539040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.576595068 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.576606989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.576649904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.576956987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.576971054 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.577018023 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.577028036 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.577042103 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.577070951 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.577390909 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.577404976 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.577460051 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.577471018 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.577502966 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.577898026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.577912092 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.577965021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.577974081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.578007936 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.578356981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.578371048 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.578422070 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.578433990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.578466892 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.578790903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.578804016 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.578855991 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.578866005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.578896999 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.579314947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.579328060 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.579372883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.579385996 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.579418898 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.579741001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.579755068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.579806089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.579818010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.579849958 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.580246925 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.580262899 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.580312967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.580322981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.580359936 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.580743074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.580759048 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.580816984 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.580831051 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.580866098 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.581232071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.581247091 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.581295013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.581307888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.581342936 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.581732035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.581744909 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.581794977 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.581806898 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.581841946 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.582202911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.582216024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.582268953 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.582278967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.582313061 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.582669020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.582683086 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.582735062 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.582747936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.582782030 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.583117008 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.583129883 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.583190918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.583201885 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.583235979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.583554029 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.583570004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.583616972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.583626986 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.583647013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.583662987 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.584054947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.584069014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.584115028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.584124088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.584151983 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.584161043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.584475040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.584491014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.584534883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.584544897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.584563017 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.584580898 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.584887981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.584903955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.584937096 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.584945917 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.584973097 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.584996939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.585634947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.585649014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.585700989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.585714102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.585730076 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.585751057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.586110115 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.586122990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.586160898 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.586174965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.586190939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.586210966 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.586508989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.586523056 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.586574078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.586586952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.586621046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.586963892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.586977959 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.587012053 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.587023973 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.587043047 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.587060928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.587467909 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.587481976 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.587534904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.587548018 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.587562084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.587580919 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.587949038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.587966919 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.588026047 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.588037968 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.588076115 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.588329077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.588344097 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.588391066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.588402987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.588418961 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.588442087 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.588835001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.588850021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.588890076 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.588900089 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.588918924 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.588937044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.589314938 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.589332104 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.589386940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.589396954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.589432955 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.589799881 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.589814901 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.589864969 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.589874983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.589889050 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.589910984 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.590276003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.590290070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.590348959 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.590358973 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.590396881 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.590893984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.590905905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.590949059 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.590960026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.590974092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.590992928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.591305971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.591320038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.591373920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.591383934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.591419935 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.591799021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.591811895 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.591855049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.591866016 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.591877937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.591900110 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.592215061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.592232943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.592287064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.592295885 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.592331886 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.592771053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.592784882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.592825890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.592838049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.592849016 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.592870951 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.593214035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.593228102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.593281984 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.593291998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.593326092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.593871117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.593885899 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.593923092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.593931913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.593947887 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.593966961 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.594279051 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.594295025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.594347000 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.594356060 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.594389915 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.594696045 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.594710112 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.594748974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.594758034 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.594773054 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.594793081 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.595182896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.595199108 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.595243931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.595252037 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.595267057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.595287085 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.595696926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.595710993 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.595769882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.595779896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.595817089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.596194029 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.596208096 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.596249104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.596257925 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.596272945 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.596293926 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.596702099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.596715927 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.596765041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.596774101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.596787930 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.596807957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.597268105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.597280979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.597325087 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.597335100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.597348928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.597368956 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.597639084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.597652912 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.597702026 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.597711086 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.597735882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.597735882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.597754955 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.598663092 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.598675966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.598721981 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.598731995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.598746061 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.598783016 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.599455118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.599467993 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.599524021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.599533081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.599546909 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.599565029 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.599942923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.599957943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.599999905 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.600008011 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.600027084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.600044012 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.600338936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.600352049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.600403070 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.600413084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.600447893 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.600692034 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.600703955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.600738049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.600745916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.600761890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.600783110 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.601262093 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.601274967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.601325035 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.601335049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.601356030 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.601370096 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.602058887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.602073908 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.602127075 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.602135897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.602149010 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.602170944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.602480888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.602494955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.602540016 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.602550030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.602564096 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.602582932 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.603049994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.603064060 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.603120089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.603130102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.603168011 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.603857994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.603873014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.603925943 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.603938103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.603952885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.603970051 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.604532003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.604546070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.604598999 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.604609013 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.604921103 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.605037928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.605051041 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.605093002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.605101109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.605118990 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.605416059 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.605632067 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.605647087 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.605686903 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.605695963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.605710983 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.605787992 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.606192112 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.606205940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.606261969 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.606271982 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.606328964 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.606669903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.606683969 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.606738091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.606745958 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.606997013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.607220888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.607237101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.607285023 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.607295036 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.607310057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.607556105 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.607819080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.607835054 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.607884884 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.607892036 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.607980013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.608340979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.608355045 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.608424902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.608432055 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.608525038 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.608948946 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.608963013 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.609014988 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.609020948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.609112978 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.609680891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.609723091 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.609744072 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.609751940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.609775066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.609786034 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.610213041 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.610225916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.610274076 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.610281944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.610294104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.610325098 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.610702991 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.610717058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.610763073 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.610769033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.610783100 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.610805988 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.611155987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.611183882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.611232996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.611238956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.611253023 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.611515999 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.611548901 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.611562014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.611610889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.611618042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.611633062 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.611715078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.612247944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.612265110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.612322092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.612329006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.612421989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.612720966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.612735033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.612792969 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.612802029 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.613055944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.613188028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.613202095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.613249063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.613255978 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.613507032 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.613606930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.613620996 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.613677025 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.613686085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.613698006 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.613774061 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.614073992 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.614087105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.614136934 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.614145994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.614236116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.614542007 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.614553928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.614602089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.614614010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.614626884 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.614818096 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.615010023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.615046024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.615061045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.615072966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.615089893 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.615108013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.615473986 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.615490913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.615525961 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.615539074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.615555048 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.615892887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.615911007 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.615942955 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.615953922 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.615969896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.615986109 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.616314888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.616328001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.616365910 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.616374969 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.616388083 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.616596937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.616761923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.616777897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.616825104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.616836071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.617239952 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.617266893 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.617280006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.617328882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.617337942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.617428064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.617782116 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.617794991 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.617840052 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.617850065 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.617863894 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.617949009 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.618149042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.618161917 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.618211985 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.618220091 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.618236065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.618323088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.618727922 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.618741989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.618793011 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.618803978 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.618887901 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.619241953 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.619261026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.619323015 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.619333982 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.619415998 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.619729996 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.619744062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.619788885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.619797945 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.619813919 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.619836092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.620162964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.620177984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.620234966 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.620243073 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.620496035 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.620652914 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.620666981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.620707035 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.620723963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.620740891 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.620985985 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.621238947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.621253014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.621294022 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.621301889 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.621392012 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.621536970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.621552944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.621607065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.621614933 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.621701002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.621970892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.621984959 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.622031927 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.622040033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.622052908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.622071028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.622462988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.622498989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.622530937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.622544050 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.622564077 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.622628927 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.622925043 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.622939110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.622993946 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.623006105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.623085976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.623379946 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.623394966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.623440981 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.623451948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.623465061 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.623555899 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.623918056 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.623933077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.623986959 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.624001026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.624080896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.624454975 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.624469042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.624516010 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.624526024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.624612093 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.624917030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.624929905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.624988079 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.624996901 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.625240088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.625432014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.625446081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.625494957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.625504971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.625585079 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.625842094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.625861883 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.625906944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.625915051 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.625929117 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.626013994 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.626411915 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.626430988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.626482010 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.626492023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.626579046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.626926899 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.626940012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.626985073 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.626993895 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.627007008 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.627260923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.627278090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.627300978 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.627311945 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.627326012 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.627429962 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.627681017 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.627693892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.627742052 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.627753019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.627764940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.627793074 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.628130913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.628145933 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.628196955 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.628212929 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.628298044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.628627062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.628642082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.628696918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.628704071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.628715992 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.628804922 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.629182100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.629198074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.629247904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.629259109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.629345894 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.629740000 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.629755020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.629807949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.629817963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.629904985 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.630198956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.630212069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.630251884 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.630264044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.630279064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.630337000 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.630810022 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.630822897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.630873919 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.630883932 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.630970955 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.631288052 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.631302118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.631345987 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.631356001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.631369114 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.631454945 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.631674051 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.631688118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.631738901 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.631748915 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.631835938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.632142067 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.632155895 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.632196903 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.632205963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.632235050 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.632309914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.632586002 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.632600069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.632651091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.632662058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.632749081 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.633091927 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.633106947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.633150101 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.633158922 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.633183002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.633423090 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.633513927 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.633533001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.633579016 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.633593082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.633671045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.633996964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.634011030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.634058952 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.634069920 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.634157896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.634407043 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.634419918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.634463072 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.634470940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.634485960 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.634572029 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.635001898 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.635015011 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.635061979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.635068893 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.635086060 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.635101080 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.635234118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.635272980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.635288954 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.635297060 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.635309935 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.635328054 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.635622978 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.635638952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.635694027 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.635704994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.635947943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.635957003 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.635967016 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.635979891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.635993958 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.636018038 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.636039972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.636279106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.636291981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.636346102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.636354923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.636558056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.637063980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.637079000 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.637126923 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.637134075 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.637218952 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.637484074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.637496948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.637547970 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.637554884 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.637568951 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.637598038 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.637883902 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.637897968 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.637955904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.637964010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.638055086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.638272047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.638286114 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.638343096 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.638350010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.638437986 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.638741016 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.638755083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.638813972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.638820887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.638911009 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.639132023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.639146090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.639199972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.639209986 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.639292955 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.639653921 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.639667034 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.639718056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.639729977 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.639816999 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.640149117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.640168905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.640227079 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.640247107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.640314102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.640855074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.640870094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.640918016 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.640933037 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.640949011 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.641025066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.641252995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.641282082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.641325951 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.641339064 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.641355991 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.641434908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.641684055 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.641697884 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.641743898 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.641753912 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.641840935 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.642069101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.642082930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.642139912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.642153025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.642169952 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.642405987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.642407894 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.642416954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.642455101 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.642456055 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.642477989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.642507076 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.642899990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.642913103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.642966032 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.642978907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.642992973 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.643085957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.643409014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.643425941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.643477917 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.643487930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.643579006 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.643915892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.643929958 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.643980026 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.643990040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.644078970 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.644324064 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.644337893 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.644387960 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.644397974 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.644484997 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.644929886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.644943953 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.644984007 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.644993067 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.645009995 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.645093918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.645510912 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.645530939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.645581007 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.645591021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.645952940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.645970106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.646008968 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.646018028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.646029949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.646058083 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.646871090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.646891117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.646951914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.646961927 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.647546053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.647572041 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.647612095 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.647622108 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.647646904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.647665977 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.647880077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.647901058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.647941113 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.647948980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.647964001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.648390055 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.648415089 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.648452044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.648462057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.648477077 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.648502111 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.648794889 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.648813009 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.648865938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.648874998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.649218082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.649239063 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.649275064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.649286032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.649305105 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.649326086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.649607897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.649622917 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.649666071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.649673939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.649688005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.649975061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.649993896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.650032997 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.650041103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.650059938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.650080919 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.650692940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.650712967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.650768042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.650778055 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.651149988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.651168108 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.651206017 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.651216030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.651231050 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.651248932 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.651580095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.651596069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.651650906 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.651659966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.652158022 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.652177095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.652226925 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.652242899 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.652260065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.652564049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.652580023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.652632952 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.652642012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.652656078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.652679920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.653167009 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.653186083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.653238058 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.653245926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.653659105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.653678894 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.653726101 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.653733969 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.653747082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.654103994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.654118061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.654170990 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.654181004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.654623032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.654643059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.654653072 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.654659986 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.654678106 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.654702902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.655246019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.655267954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.655323982 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.655333042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.655966043 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.655988932 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.656028032 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.656037092 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.656060934 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.656480074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.656495094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.656549931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.656558990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.656722069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.656740904 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.656769991 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.656776905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.656790018 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.656814098 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.657380104 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.657396078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.657438993 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.657447100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.657460928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.657776117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.657794952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.657845974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.657856941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.658252001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.658266068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.658304930 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.658313990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.658334970 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.658782005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.658801079 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.658847094 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.658858061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.658869028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.659023046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.659322023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.659337044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.659384012 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.659390926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.659403086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.659810066 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.659830093 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.659873962 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.659881115 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.659894943 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.659921885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.660147905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.660161972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.660200119 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.660206079 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.660226107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.660670042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.660689116 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.660729885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.660736084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.660748005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.660772085 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.661118031 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.661134005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.661195993 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.661202908 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.661618948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.661638021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.661689043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.661695957 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.661724091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.661732912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.662035942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.662050009 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.662094116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.662100077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.662130117 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.662138939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.662492990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.662514925 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.662571907 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.662579060 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.662591934 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.663141012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.663161993 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.663198948 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.663204908 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.663217068 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.663242102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.663664103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.663681030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.663741112 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.663748026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.663758993 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.663784027 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.664252043 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.664268970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.664318085 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.664324045 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.664336920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.664583921 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.664603949 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.664647102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.664658070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.664669991 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.664691925 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.664968014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.664980888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.665024042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.665034056 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.665047884 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.665433884 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.665462017 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.665493965 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.665505886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.665518999 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.665539980 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.665868998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.665884018 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.665930033 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.665941000 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.665955067 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.666271925 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.666290045 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.666327000 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.666337967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.666354895 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.666662931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.666739941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.666754961 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.666795969 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.666816950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.666835070 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.667088985 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.667108059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.667155981 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.667165995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.667537928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.667665958 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.667680979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.667726040 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.667735100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.667821884 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.668387890 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.668404102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.668448925 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.668458939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.668473959 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.668493032 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.668840885 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.668855906 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.668912888 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.668920994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.669003963 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.669198990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.669214010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.669260025 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.669269085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.669569016 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.669593096 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.669595003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.669609070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.669626951 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.669648886 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.670145988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.670162916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.670213938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.670222044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.670373917 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.670542955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.670573950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.670607090 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.670614004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.670624971 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.670874119 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.671098948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.671113968 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.671159983 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.671168089 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.671416044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.671509981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.671525002 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.671570063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.671576977 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.671588898 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.671679020 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.671977043 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.671991110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.672039986 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.672046900 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.672061920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.672311068 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.672365904 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.672380924 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.672426939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.672435999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.672449112 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.672538996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.672806978 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.672821999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.672877073 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.672885895 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.672898054 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.673177958 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.673230886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.673247099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.673297882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.673305035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.673578024 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.673743010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.673758030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.673806906 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.673813105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.673825979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.674098015 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.674112082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.674128056 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.674177885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.674185038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.674196959 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.674356937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.674700022 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.674715996 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.674757004 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.674763918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.674781084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.675210953 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.675240040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.675256968 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.675299883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.675306082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.675327063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.675348043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.675795078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.675810099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.675853968 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.675860882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.675884008 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.675894976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.676196098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.676211119 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.676260948 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.676269054 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.676284075 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.676804066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.676875114 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.676893950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.676950932 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.676959991 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.676973104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.677632093 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.677650928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.677700996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.677709103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.677725077 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.677752018 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.678422928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.678436995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.678500891 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.678508043 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.678608894 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.678685904 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.678700924 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.678755045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.678761959 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.678982973 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.678998947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.678998947 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.679011106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.679022074 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.679044962 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.679066896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.679359913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.679372072 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.679420948 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.679428101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.679455996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.679716110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.679730892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.679783106 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.679790020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.679802895 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.679831028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.680062056 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.680078983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.680129051 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.680135012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.680416107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.680578947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.680594921 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.680644989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.680651903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.680952072 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.681035042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.681051970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.681114912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.681123018 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.681411982 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.681441069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.681457043 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.681514978 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.681520939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.681807041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.681901932 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.681915998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.681958914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.681965113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.681997061 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.682008982 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.682384014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.682403088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.682461023 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.682468891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.682610989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.682820082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.682835102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.682882071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.682888985 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.682909012 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.683197975 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.683314085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.683330059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.683384895 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.683391094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.683676958 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.683760881 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.683783054 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.683832884 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.683842897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.684129000 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.684163094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.684179068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.684225082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.684231997 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.684248924 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.684268951 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.684514999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.684530973 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.684590101 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.684597969 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.684892893 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.684967041 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.684982061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.685029984 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.685036898 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.685055971 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.685321093 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.685333014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.685342073 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.685353994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.685375929 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.685405970 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.685703039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.685718060 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.685771942 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.685781002 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.685794115 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.685822964 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.686229944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.686247110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.686305046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.686312914 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.686382055 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.686743975 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.686760902 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.686810017 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.686816931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.686835051 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.686860085 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.687280893 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.687297106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.687351942 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.687359095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.687648058 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.687741995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.687757969 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.687807083 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.687813044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.688106060 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.688277006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.688293934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.688348055 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.688355923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.688366890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.688472033 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.688725948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.688741922 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.688798904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.688805103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.689093113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.689097881 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.689105034 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.689146996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.689146042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.689168930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.689204931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.689549923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.689565897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.689620972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.689630032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.689925909 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.690107107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.690123081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.690169096 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.690174103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.690187931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.690217018 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.690512896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.690534115 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.690591097 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.690598965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.690653086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.690968037 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.690980911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.691029072 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.691037893 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.691049099 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.691140890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.691427946 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.691442013 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.691497087 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.691504002 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.691767931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.691920996 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.691934109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.691978931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.691986084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.691998005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.692080021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.692229986 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.692244053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.692291975 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.692300081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.692393064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.692536116 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.692548990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.692593098 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.692599058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.692610025 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.693010092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.693146944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.693164110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.693212986 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.693222046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.693573952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.693593025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.693646908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.693655014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.693689108 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.693711042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.694329977 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.694366932 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.694407940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.694415092 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.694438934 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.694459915 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.694555044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.694576979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.694614887 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.694621086 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.694648027 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.694658041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.695013046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.695034027 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.695087910 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.695095062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.695106983 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.695456028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.695482016 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.695521116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.695528984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.695543051 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.695571899 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.695827007 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.695853949 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.695909977 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.695916891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.696333885 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.696357965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.696397066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.696407080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.696419954 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.696448088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.696657896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.696679115 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.696728945 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.696734905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.696747065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.697199106 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.697230101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.697254896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.697307110 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.697314024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.697715998 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.697848082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.697869062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.697917938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.697926044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.697940111 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.698285103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.698311090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.698314905 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.698332071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.698347092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.698381901 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.698851109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.698870897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.698928118 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.698934078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.699279070 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.699436903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.699501038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.699517965 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.699523926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.699553967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.699570894 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.699912071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.699935913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.699980021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.699985981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.700012922 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.700330019 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.700354099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.700381994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.700427055 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.700433016 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.700448036 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.700469971 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.701102018 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.701122046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.701175928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.701185942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.701484919 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.701775074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.701795101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.701842070 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.701849937 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.702159882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.702305079 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.702325106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.702363014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.702369928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.702395916 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.702676058 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.702775955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.702796936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.702847958 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.702853918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.703207016 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.703259945 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.703280926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.703321934 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.703327894 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.703353882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.703645945 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.703684092 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.703711987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.703761101 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.703768015 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.704056978 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.704267979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.704288960 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.704330921 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.704336882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.704360962 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.704369068 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.704684973 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.704708099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.704754114 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.704761028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.704775095 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.704796076 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.705158949 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.705184937 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.705231905 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.705241919 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.705265045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.705600023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.705624104 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.705638885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.705645084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.705670118 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.705697060 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.706058979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.706080914 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.706120014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.706129074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.706141949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.706172943 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.706557035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.706579924 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.706634998 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.706641912 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.706861019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.706882954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.706921101 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.706928015 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.706942081 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.706965923 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.707269907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.707290888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.707343102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.707349062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.707652092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.707809925 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.707834959 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.707879066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.707885981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.708352089 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.708375931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.708420038 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.708425999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.708445072 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.708477020 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.708695889 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.708714962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.708755970 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.708761930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.708774090 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.709058046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.709119081 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.709121943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.709141016 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.709182024 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.709487915 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.709506035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.709551096 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.709558964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.709801912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.709925890 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.709947109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.709990025 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.709995985 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.710011005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.710038900 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.710407972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.710427999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.710478067 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.710484982 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.710500002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.710730076 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.710755110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.710793018 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.710799932 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.710813046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.710843086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.711149931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.711170912 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.711215973 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.711222887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.711236000 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.711519957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.711688042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.711718082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.711756945 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.711766958 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.711781979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.712058067 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.712203979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.712243080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.712271929 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.712280035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.712295055 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.712317944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.712668896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.712696075 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.712748051 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.712764025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.713041067 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.713066101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.713100910 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.713109970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.713123083 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.713148117 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.713480949 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.713500977 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.713556051 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.713562965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.713660955 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.714104891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.714126110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.714180946 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.714186907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.714301109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.714323997 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.714358091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.714365005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.714391947 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.714412928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.714878082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.714896917 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.714937925 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.714946032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.714958906 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.715251923 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.715300083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.715327978 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.715378046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.715384960 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.715661049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.715961933 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.715986967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.716028929 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.716038942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.716053963 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.716332912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.716406107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.716428995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.716475964 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.716481924 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.716763973 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.716876984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.716897964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.716934919 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.716941118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.716969013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.716975927 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.717335939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.717359066 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.717402935 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.717410088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.717431068 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.717444897 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.717771053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.717792988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.717844963 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.717854023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.718138933 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.718185902 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.718206882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.718255043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.718262911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.718358040 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.718770981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.718795061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.718842983 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.718852043 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.718864918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.719100952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.719125032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.719163895 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.719181061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.719194889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.719461918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.719702005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.719722033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.719765902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.719772100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.719784021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.719813108 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.720108032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.720135927 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.720185041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.720194101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.720207930 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.720488071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.720583916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.720603943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.720653057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.720659971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.720670938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.720947027 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.721023083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.721048117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.721090078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.721096992 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.721117020 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.721390963 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.721616983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.721642017 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.721688032 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.721695900 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.722044945 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.722136021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.722162962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.722213030 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.722219944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.722507000 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.722574949 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.722600937 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.722649097 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.722656965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.722672939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.722690105 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.723431110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.723453999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.723507881 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.723515034 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.723535061 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.723555088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.724292994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.724313974 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.724358082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.724364996 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.724379063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.724693060 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.724791050 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.724812031 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.724865913 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.724872112 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.725167036 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.725414038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.725435019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.725481987 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.725488901 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.725769997 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.725931883 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.725953102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.725996971 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.726005077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.726283073 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.726516008 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.726536989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.726588964 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.726597071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.726880074 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.727035046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.727058887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.727108002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.727116108 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.727401018 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.727533102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.727552891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.727602005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.727610111 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.727893114 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.727914095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.727935076 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.727982044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.727989912 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.728260040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.728266954 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.728276968 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.728301048 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.728315115 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.728338003 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.728355885 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.728375912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.728399038 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.728616953 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.728635073 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.728688002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.728697062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.729211092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.729229927 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.729264021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.729285955 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.729291916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.729315996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.729336023 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.729666948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.729687929 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.729728937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.729736090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.729762077 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.729770899 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.730179071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.730207920 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.730258942 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.730267048 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.730279922 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.730303049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.730535030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.730556011 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.730602026 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.730609894 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.730626106 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.730737925 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.731000900 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.731020927 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.731076956 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.731085062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.731389046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.731561899 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.731583118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.731633902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.731642962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.731921911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.732028961 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.732049942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.732099056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.732105970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.732387066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.732521057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.732542038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.732580900 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.732587099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.732599974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.732623100 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.732780933 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.732801914 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.732836008 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.732845068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.732861996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.733068943 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.733390093 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.733412027 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.733463049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.733469963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.733495951 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.733535051 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.733552933 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.733560085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.733589888 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.733611107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.733829021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.733850002 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.733890057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.733897924 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.733911037 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.733937025 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.734411955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.734440088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.734479904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.734488010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.734505892 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.734524012 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.735920906 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.735986948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.736017942 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.736025095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.736036062 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.736063004 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.736152887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.736200094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.736242056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.736248970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.736259937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.736361980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.736413956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.736427069 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.736459970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.736480951 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.736505032 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.736747980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.736794949 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.736825943 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.736831903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.736844063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.736864090 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.736874104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.736896992 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.736938953 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.736954927 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.736960888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.736983061 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.737003088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.737262964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.737310886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.737340927 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.737345934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.737360954 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.737375975 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.737382889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.737788916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.737831116 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.737855911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.737863064 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.737886906 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.737905025 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.738333941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.738382101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.738409042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.738415956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.738437891 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.738452911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.738607883 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.738679886 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.738704920 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.738770962 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.738903046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.738945961 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.738976002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.738981962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.738993883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.739021063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.739506006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.739548922 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.739589930 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.739598036 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.739610910 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.740083933 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.740130901 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.740158081 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.740164995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.740192890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.740232944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.740422010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.740472078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.740499020 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.740506887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.740520954 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.740540981 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.740552902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.741033077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.741077900 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.741108894 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.741116047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.741141081 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.741147995 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.741230011 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.741271973 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.741297007 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.741302967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.741328001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.741345882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.741581917 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.741627932 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.741662979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.741668940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.741682053 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.741703987 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.742125034 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.742172956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.742204905 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.742211103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.742234945 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.742382050 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.742722988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.742763042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.742794037 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.742800951 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.742818117 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.742839098 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.743168116 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.743216991 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.743244886 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.743252039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.743278027 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.743290901 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.743674040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.743721962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.743746996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.743753910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.743776083 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.743791103 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.744347095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.744390965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.744411945 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.744419098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.744442940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.744458914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.744828939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.744869947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.744891882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.744901896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.744924068 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.744940042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.745368958 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.745417118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.745445967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.745454073 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.745474100 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.745488882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.745986938 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.746026039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.746052980 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.746059895 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.746078968 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.746094942 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.746403933 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.746443987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.746464014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.746471882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.746498108 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.746510983 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.747054100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.747100115 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.747123957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.747131109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.747153044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.747168064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.747486115 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.747526884 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.747551918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.747559071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.747582912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.747598886 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.748020887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.748070002 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.748100042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.748106956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.748121023 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.748138905 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.748500109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.748552084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.748580933 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.748588085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.748610973 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.748625994 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.748902082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.748929977 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.748964071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.748970032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.748991966 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.749001980 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.749386072 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.749402046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.749454021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.749463081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.749741077 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.749763966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.749778986 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.749819994 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.749825954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.749850035 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.749866962 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.750193119 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.750207901 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.750252962 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.750258923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.750282049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.750296116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.750747919 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.750766993 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.750823021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.750829935 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.751234055 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.751269102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.751288891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.751334906 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.751343012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.751630068 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.751849890 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.751908064 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.751956940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.751965046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.752245903 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.752510071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.752525091 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.752568960 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.752574921 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.752599955 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.752612114 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.753019094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.753036976 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.753083944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.753089905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.753366947 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.753477097 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.753504038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.753551960 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.753557920 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.753824949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.754082918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.754106998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.754148006 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.754157066 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.754425049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.754517078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.754532099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.754573107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.754579067 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.754597902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.754616976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.754996061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.755012035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.755049944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.755057096 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.755079985 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.755095005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.755492926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.755511999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.755564928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.755579948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.755856991 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.756006002 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.756021976 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.756067038 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.756074905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.756555080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.756576061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.756616116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.756623983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.756635904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.756658077 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.757054090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.757072926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.757123947 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.757132053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.757476091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.757513046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.757536888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.757576942 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.757582903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.757854939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.758057117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.758074999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.758116007 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.758124113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.758344889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.758562088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.758584023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.758626938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.758635044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.758650064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.758672953 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.759084940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.759099960 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.759151936 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.759161949 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.759507895 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.759586096 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.759604931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.759653091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.759658098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.759974957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.760123014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.760138988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.760181904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.760186911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.760504961 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.760555983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.760571957 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.760616064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.760621071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.760946989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.761049986 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.761066914 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.761112928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.761120081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.761404037 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.761455059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.761471033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.761514902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.761519909 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.761780024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.761797905 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.761797905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.761810064 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.761822939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.761853933 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.762403965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.762417078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.762471914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.762479067 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.762764931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.762769938 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.762783051 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.762801886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.762819052 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.762836933 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.762842894 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.762857914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.763108969 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.763238907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.763252974 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.763293028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.763300896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.763323069 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.763338089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.763578892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.763598919 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.763652086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.763658047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.763757944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.764010906 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.764031887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.764090061 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.764096975 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.764374018 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.764475107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.764492035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.764537096 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.764544010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.764823914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.764977932 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.764991045 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.765038013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.765043974 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.765320063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.765549898 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.765563965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.765615940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.765623093 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.765899897 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.766207933 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.766223907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.766268015 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.766274929 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.766612053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.766630888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.766664982 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.766670942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.766688108 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.766710997 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.767088890 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.767103910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.767153978 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.767162085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.767539978 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.767558098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.767573118 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.767579079 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.767592907 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.767620087 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.768145084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.768162966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.768209934 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.768225908 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.768708944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.768727064 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.768781900 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.768791914 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.768906116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.769287109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.769300938 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.769357920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.769366026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.769658089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.769680977 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.769696951 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.769736052 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.769742966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.769754887 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.770036936 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.770163059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.770181894 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.770236015 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.770245075 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.770509005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.770690918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.770705938 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.770756960 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.770761967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.770787001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.771155119 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.771173954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.771224976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.771230936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.771241903 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.771272898 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.771672964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.771687984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.771749020 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.771754026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.771766901 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.772092104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.772176981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.772193909 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.772241116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.772247076 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.772330046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.772622108 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.772639036 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.772690058 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.772696972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.772990942 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.773108006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.773123980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.773173094 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.773179054 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.773451090 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.773504019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.773518085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.773561001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.773566008 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.773591042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.773603916 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.773972988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.773992062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.774049997 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.774055004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.774328947 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.774471045 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.774490118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.774540901 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.774545908 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.774821043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.774990082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.775007010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.775053978 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.775058985 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.775335073 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.775470018 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.775485039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.775537968 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.775543928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.775818110 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.776010036 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.776024103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.776067972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.776072979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.776098967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.776333094 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.776510000 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.776535988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.776593924 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.776601076 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.776940107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.776978970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.776998997 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.777044058 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.777049065 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.777322054 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.777513981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.777530909 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.777573109 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.777576923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.777591944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.777856112 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.777951002 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.777971983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.778017044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.778023005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.778297901 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.778448105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.778462887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.778506041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.778511047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.778538942 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.778546095 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.778995037 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.779012918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.779069901 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.779076099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.779350042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.779417038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.779436111 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.779480934 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.779485941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.779758930 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.779902935 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.779920101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.779964924 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.779970884 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.779992104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.780010939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.780292988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.780314922 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.780369997 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.780375957 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.780658007 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.780755043 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.780791044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.780822992 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.780828953 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.780854940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.780869007 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.781249046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.781263113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.781317949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.781326056 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.781610966 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.781758070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.781773090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.781824112 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.781831026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.782108068 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.782298088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.782315969 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.782367945 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.782377005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.782659054 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.782731056 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.782747984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.782797098 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.782802105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.783081055 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.783155918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.783175945 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.783224106 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.783229113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.783588886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.783612967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.783720016 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.783725977 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.784027100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.784039974 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.784080982 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.784087896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.784112930 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.784135103 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.784480095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.784498930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.784554005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.784560919 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.784678936 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.784929991 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.784945965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.784996033 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.785001040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.785012007 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.785290956 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.785414934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.785449982 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.785476923 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.785490990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.785506964 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.785773993 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.785815001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.785836935 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.785882950 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.785890102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.786201000 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.786263943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.786282063 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.786324978 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.786330938 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.786355972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.786597013 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.786614895 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.786655903 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.786662102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.786674976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.786708117 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.787025928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.787045002 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.787100077 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.787106037 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.787132978 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.787152052 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.787451982 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.787466049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.787525892 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.787532091 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.787882090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.787899971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.787946939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.787952900 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.787967920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.787997007 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.788360119 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.788376093 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.788436890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.788443089 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.788799047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.788817883 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.788871050 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.788877010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.788893938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.789254904 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.789277077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.789315939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.789321899 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.789334059 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.789366007 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.789714098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.789740086 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.789803028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.789808989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.789819956 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.790107965 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.790163994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.790178061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.790232897 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.790240049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.790649891 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.790817976 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.790834904 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.790883064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.790888071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.791171074 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.791254044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.791271925 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.791320086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.791328907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.791599989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.791778088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.791791916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.791843891 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.791850090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.792124033 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.792290926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.792308092 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.792361021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.792367935 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.792458057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.792752981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.792773008 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.792825937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.792833090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.793104887 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.793281078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.793299913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.793351889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.793358088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.793631077 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.793798923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.793817997 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.793869972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.793874979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.794146061 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.794250011 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.794270992 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.794322014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.794328928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.794594049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.794859886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.794878006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.794929028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.794934988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.795207024 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.795326948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.795348883 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.795393944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.795399904 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.795737982 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.795944929 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.795959949 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.796011925 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.796019077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.796334028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.796411991 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.796427965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.796473026 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.796479940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.796494961 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.796812057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.797013044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.797030926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.797080994 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.797086954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.797360897 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.797511101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.797527075 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.797574997 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.797580957 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.797596931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.797864914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.797916889 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.797936916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.797986984 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.797991991 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.798257113 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.798350096 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.798366070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.798418045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.798424959 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.798687935 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.798795938 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.798814058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.798870087 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.798876047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.799139023 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.799328089 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.799343109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.799392939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.799397945 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.799673080 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.799820900 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.799835920 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.799881935 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.799886942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.800062895 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.800195932 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.800215006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.800265074 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.800270081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.800280094 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.800559998 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.800703049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.800720930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.800761938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.800767899 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.800791979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.800806999 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.801098108 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.801115036 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.801167011 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.801172972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.801189899 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.801213980 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.801616907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.801636934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.801693916 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.801698923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.802092075 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.802145004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.802186966 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.802192926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.802203894 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.802236080 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.802491903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.802510023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.802553892 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.802557945 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.802582979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.802609921 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.802972078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.802985907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.803044081 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.803049088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.803356886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.803375006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.803415060 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.803422928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.803436995 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.803467035 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.804011106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.804028988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.804088116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.804095030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.804383039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.804444075 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.804465055 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.804513931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.804519892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.804790974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.804914951 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.804936886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.804986000 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.804994106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.805319071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.805336952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.805340052 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.805351019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.805365086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.805397987 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.805720091 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.805737972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.805793047 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.805802107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.806077957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.806252956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.806268930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.806318045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.806324005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.806463003 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.806715012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.806740999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.806775093 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.806781054 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.806792974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.807074070 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.807295084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.807311058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.807356119 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.807360888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.807385921 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.807398081 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.807658911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.807674885 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.807734966 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.807739973 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.808017015 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.808109045 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.808125973 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.808171034 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.808176041 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.808199883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.808460951 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.808521032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.808542967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.808595896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.808603048 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.808866978 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.808948994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.808971882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.809029102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.809034109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.809300900 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.809312105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.809333086 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.809376001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.809381008 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.809407949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.809416056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.809655905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.809670925 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.809715033 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.809720039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.809741974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.809755087 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.809983969 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.809999943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.810039997 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.810045004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.810066938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.810077906 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.810586929 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.810611963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.810669899 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.810676098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.810956955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.810976028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.811014891 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.811019897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.811047077 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.811068058 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.811323881 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.811337948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.811393023 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.811398029 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.811506033 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.811753988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.811768055 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.811822891 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.811830044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.812123060 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.812161922 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.812211037 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.812232971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.812253952 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.812273979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.812278986 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.812292099 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.812340975 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.812607050 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.812623024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.812680006 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.812685966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.812772989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.813077927 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.813101053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.813153982 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.813159943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.813251019 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.813406944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.813426971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.813479900 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.813487053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.813584089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.813957930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.813975096 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.814032078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.814038038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.814127922 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.814449072 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.814464092 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.814517975 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.814523935 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.814615965 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.814846039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.814861059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.814914942 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.814920902 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.815009117 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.815310001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.815325022 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.815380096 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.815385103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.815397978 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.815489054 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.815725088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.815743923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.815793991 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.815800905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.815891981 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.816206932 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.816232920 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.816270113 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.816277027 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.816291094 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.816314936 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.816740036 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.816756010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.816812038 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.816817999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.817104101 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.817261934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.817282915 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.817333937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.817338943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.817610025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.817630053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.817670107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.817676067 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.817698002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.817722082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.818005085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.818027020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.818098068 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.818104029 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.818326950 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.818463087 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.818478107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.818514109 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.818520069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.818555117 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.818566084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.818906069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.818922997 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.818983078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.818989038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.819335938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.819407940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.819422960 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.819480896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.819485903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.819509029 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.819529057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.820014954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.820031881 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.820086956 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.820094109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.820334911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.820543051 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.820558071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.820606947 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.820614100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.820627928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.820909023 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.820923090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.820939064 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.820976019 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.820980072 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.821002960 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.821022034 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.821252108 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.821268082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.821317911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.821325064 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.821337938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.821655989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.821657896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.821670055 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.821707010 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.821706057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.821729898 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.821733952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.821753979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.821775913 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.822137117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.822174072 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.822227001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.822232962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.822247028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.822266102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.822483063 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.822501898 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.822549105 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.822557926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.822843075 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.822855949 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.822875023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.822921991 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.822927952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.823201895 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.823230028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.823246002 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.823291063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.823296070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.823312998 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.823579073 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.823729038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.823761940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.823791027 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.823795080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.823822021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.823841095 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.824166059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.824181080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.824235916 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.824243069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.824518919 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.824707031 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.824721098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.824764013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.824769020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.824784040 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.824807882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.825074911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.825093985 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.825150967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.825155973 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.825431108 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.825433969 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.825444937 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.825484991 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.825488091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.825503111 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.825540066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.825918913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.825941086 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.825997114 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.826003075 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.826281071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.826370001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.826390982 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.826445103 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.826451063 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.826718092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.826785088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.826798916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.826853037 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.826858044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.827125072 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.827126980 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.827133894 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.827168941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.827183962 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.827195883 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.827219009 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.827233076 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.827553988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.827568054 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.827622890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.827630997 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.827912092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.828159094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.828176975 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.828231096 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.828243017 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.828330040 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.828574896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.828597069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.828645945 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.828655005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.828669071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.828947067 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.828983068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.828999996 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.829049110 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.829056025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.829327106 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.829391003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.829406023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.829452038 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.829459906 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.829781055 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.829837084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.829854965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.829900026 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.829907894 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.829924107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.829941988 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.830224991 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.830240011 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.830286026 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.830296993 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.830312967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.830598116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.830653906 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.830677032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.830724001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.830733061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.830997944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.831115007 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.831135988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.831176996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.831185102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.831465960 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.831526995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.831547022 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.831592083 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.831599951 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.831615925 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.831888914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.832020998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.832040071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.832087040 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.832094908 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.832113028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.832329035 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.832483053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.832505941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.832554102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.832561970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.832848072 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.832926035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.832941055 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.832984924 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.832993984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.833375931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.833395004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.833441973 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.833453894 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.833468914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.833491087 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.833909988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.833924055 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.833982944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.833993912 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.834395885 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.834414005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.834456921 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.834466934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.834485054 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.834508896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.834979057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.834994078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.835032940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.835050106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.835062981 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.835377932 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.835395098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.835439920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.835449934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.835464954 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.835486889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.835966110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.835979939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.836026907 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.836036921 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.836328030 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.836440086 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.836456060 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.836505890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.836517096 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.836807013 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.836824894 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.836864948 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.836874008 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.836893082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.836920977 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.837181091 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.837196112 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.837244034 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.837250948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.837270975 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.837290049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.837718010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.837732077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.837791920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.837809086 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.837954998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.837973118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.838006020 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.838015079 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.838032007 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.838054895 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.838294983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.838310003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.838366985 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.838376999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.838706017 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.838728905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.838769913 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.838779926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.838798046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.838819027 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.839140892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.839158058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.839215040 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.839222908 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.839473009 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.839492083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.839524984 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.839533091 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.839557886 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.839576960 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.839766026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.839780092 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.839818001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.839823961 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.839848042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.839862108 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.840085983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.840105057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.840150118 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.840156078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.840177059 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.840194941 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.841660023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.841675043 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.841749907 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.841762066 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.843043089 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.843065977 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.843120098 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.843132019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.843167067 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.843167067 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.843257904 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.843278885 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.843317032 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.843322992 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.844264984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.844286919 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.844337940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.844347954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.844372034 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.844391108 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.844690084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.844710112 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.844767094 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.844774961 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.845232964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.845251083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.845302105 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.845309973 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.845326900 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.845350981 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.845654964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.845669985 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.845726967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.845735073 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.846268892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.846287012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.846330881 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.846338987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.846354008 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.846380949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.846738100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.846750975 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.846806049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.846812010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.847199917 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.847218990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.847259045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.847266912 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.847295046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.847312927 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.847683907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.847702026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.847763062 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.847769976 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.848344088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.849129915 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.849144936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.849220991 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.849235058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.850018978 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.850039005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.850109100 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.850117922 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.850141048 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.850159883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.850893974 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.850914955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.850961924 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.850969076 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.850995064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.851007938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.851675034 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.851689100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.851759911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.851767063 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.852150917 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.852417946 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.852435112 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.852487087 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.852493048 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.852508068 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.852551937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.853266001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.853282928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.853348970 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.853353977 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.854204893 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.854228020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.854269028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.854274035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.854295969 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.854324102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.855061054 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.855078936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.855139017 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.855144024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.855156898 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.855254889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.856004953 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.856028080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.856093884 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.856102943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.857036114 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.857064009 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.857105970 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.857115984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.857131958 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.857155085 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.858407974 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.858428001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.858485937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.858493090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.859111071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.859134912 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.859177113 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.859183073 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.859205008 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.859227896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.860233068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.860256910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.860292912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.860296965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.860320091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.861136913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.861164093 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.861200094 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.861205101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.861226082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.861253023 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.862113953 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.862143040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.862179041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.862184048 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.862207890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.862225056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.863117933 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.863171101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.863213062 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.863217115 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.863265991 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.864145041 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.864164114 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.864228010 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.864238977 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.864330053 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.864871025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.864887953 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.864949942 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.864955902 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.865704060 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.865727901 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.865766048 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.865772009 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.865808964 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.865834951 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.866444111 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.866461992 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.866518021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.866523981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.867029905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.867052078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.867090940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.867095947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.867124081 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.867147923 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.867505074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.867520094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.867569923 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.867574930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.867603064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.867614985 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.868058920 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.868074894 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.868128061 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.868134022 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.868331909 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.868554115 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.868571043 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.868621111 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.868626118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.869026899 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.869046926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.869082928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.869087934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.869112015 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.869129896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.869671106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.869688034 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.869740963 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.869745970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.870151043 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.870170116 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.870207071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.870210886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.870234966 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.870254993 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.870611906 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.870631933 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.870676994 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.870682001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.870707989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.870724916 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.871067047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.871082067 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.871129990 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.871135950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.871634960 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.871658087 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.871690989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.871697903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.871717930 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.871741056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.872081041 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.872098923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.872140884 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.872147083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.872162104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.872183084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.872642994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.872667074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.872710943 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.872719049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.873210907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.873229980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.873264074 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.873270988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.873286963 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.873313904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.873764992 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.873785019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.873821020 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.873827934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.873842955 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.873861074 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.874181986 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.874197960 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.874238968 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.874244928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.874272108 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.874286890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.874624968 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.874639988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.874689102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.874696016 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.874718904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.874737978 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.875089884 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.875113964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.875181913 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.875188112 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.875267982 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.875299931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.875317097 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.875361919 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.875368118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.875452995 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.875742912 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.875760078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.875801086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.875806093 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.875971079 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.876090050 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.876322985 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.876341105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.876400948 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.876406908 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.876456976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.876722097 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.876745939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.876791954 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.876797915 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.877074003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.877093077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.877144098 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.877149105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.877172947 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.877199888 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.877445936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.877461910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.877520084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.877526045 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.877656937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.877959967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.877975941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.878015041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.878020048 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.878043890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.878070116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.878364086 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.878384113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.878447056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.878452063 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.878664970 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.878783941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.878798962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.878843069 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.878848076 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.878870964 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.878895044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.879153967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.879169941 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.879218102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.879221916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.879575014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.879595041 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.879647017 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.879651070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.879678011 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.879702091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.880402088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.880419970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.880482912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.880489111 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.880729914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.880791903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.880806923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.880851030 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.880855083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.880875111 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.880892038 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.880995989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.881247997 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.881263971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.881323099 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.881331921 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.881520033 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.881719112 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.881736040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.881784916 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.881789923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.881825924 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.882148027 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.882164001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.882219076 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.882225990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.882281065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.882648945 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.882666111 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.882726908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.882735014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.882869959 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.883115053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.883131027 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.883174896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.883179903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.883382082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.883507013 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.883522034 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.883574963 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.883580923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.883769989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.883786917 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.884052992 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.884069920 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.884130001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.884135008 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.884421110 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.884443998 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.884608030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.884623051 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.884680033 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.884685040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.884737015 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.885147095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.885162115 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.885221004 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.885226965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.885245085 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.885271072 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.885603905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.885622025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.885658026 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.885672092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.885677099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.885895967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.886280060 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.886301041 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.886327028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.886353970 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.886358976 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.886816025 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.886857033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.886879921 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.886914968 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.886921883 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.886940002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.886970043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.887408018 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.887481928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.887501001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.887550116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.887554884 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.887914896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.887995005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.888016939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.888051033 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.888056040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.888086081 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.888108015 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.888372898 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.888391018 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.888443947 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.888449907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.888796091 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.888817072 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.888851881 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.888856888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.888884068 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.888907909 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.889204025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.889221907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.889269114 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.889273882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.889734983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.889756918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.889794111 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.889801025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.889826059 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.889847994 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.890155077 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.890466928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.890487909 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.890528917 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.890535116 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.890547991 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.890607119 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.890777111 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.891249895 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.892029047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.892086983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.892110109 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.892128944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.892146111 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.892276049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.892327070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.892333984 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.892358065 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.892388105 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.892407894 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.892504930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.892544985 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.892566919 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.892575026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.892591000 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.892610073 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.892687082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.892728090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.892750978 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.892760038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.892784119 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.892796993 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.893099070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.893141031 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.893177986 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.893186092 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.893248081 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.893567085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.893620968 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.893641949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.893651962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.893681049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.893702984 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.894150972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.894193888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.894227028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.894237995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.894256115 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.894299984 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.894676924 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.894721031 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.894754887 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.894763947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.894785881 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.894872904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.895243883 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.895283937 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.895323038 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.895330906 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.895358086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.895366907 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.895916939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.895958900 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.895994902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.896003962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.896019936 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.896212101 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.896429062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.896477938 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.896502018 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.896509886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.896527052 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.896538973 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.896554947 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.896948099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.896994114 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.897021055 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.897031069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.897063017 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.897077084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.897458076 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.897500992 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.897536039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.897543907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.897572041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.897588015 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.898036003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.898077965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.898112059 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.898121119 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.898145914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.898160934 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.898606062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.898633003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.898680925 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.898693085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.898710012 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.898766041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.899054050 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.899076939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.899111986 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.899120092 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.899133921 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.899338007 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.899614096 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.899635077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.899674892 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.899682999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.899703979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.899719000 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.900027990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.900048971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.900103092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.900111914 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.900348902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.900548935 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.900572062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.900616884 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.900624037 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.900648117 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.900648117 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.900657892 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.901108027 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.901128054 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.901161909 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.901170015 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.901191950 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.901542902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.901771069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.901796103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.901842117 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.901849985 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.901869059 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.901923895 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.902271032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.902292013 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.902335882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.902360916 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.902368069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.902415991 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.902657986 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.902698040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.902703047 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.902714968 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.902740955 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.902760983 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.903048038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.903068066 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.903100967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.903110981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.903136015 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.903151989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.903476954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.903496981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.903546095 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.903563023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.903913975 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.903939009 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.903973103 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.903983116 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.903996944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.904277086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.904329062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.904349089 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.904381990 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.904388905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.904402971 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.904658079 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.904900074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.904923916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.904962063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.904970884 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.904983044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.905069113 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.905554056 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.905575037 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.905616045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.905630112 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.905642033 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.905728102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.905883074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.905903101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.905941963 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.905951023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.905966043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.905985117 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.906373024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.906394958 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.906435966 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.906443119 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.906456947 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.906548977 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.906889915 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.906910896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.906945944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.906954050 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.906969070 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.906990051 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.907450914 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.907471895 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.907520056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.907531023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.907618046 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.907970905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.907989979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.908026934 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.908036947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.908056021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.908073902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.908394098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.908413887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.908463955 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.908471107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.908751011 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.909053087 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.909077883 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.909121990 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.909132004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.909392118 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.909588099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.909611940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.909641981 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.909648895 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.909672976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.909687996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.910145998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.910172939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.910211086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.910219908 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.910242081 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.910269022 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.910581112 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.910605907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.910651922 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.910661936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.910703897 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.911192894 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.911214113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.911251068 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.911307096 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.911314964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.911482096 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.911700964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.911720991 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.911755085 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.911762953 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.911783934 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.911803007 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.912266970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.912292957 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.912328959 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.912339926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.912355900 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.912374973 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.912796021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.912817001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.912863970 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.912873030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.912884951 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.912918091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.913332939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.913378954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.913424015 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.913431883 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.913448095 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.913466930 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.913808107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.913831949 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.913881063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.913889885 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.913933039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.914197922 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.914216995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.914252043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.914261103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.914283037 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.914297104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.914777994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.914798975 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.914851904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.914863110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.914877892 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.914895058 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.915205956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.915227890 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.915272951 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.915280104 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.915307045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.915322065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.915673971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.915693998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.915730953 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.915739059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.915764093 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.915779114 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.916171074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.916191101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.916233063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.916240931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.916271925 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.916290045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.916701078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.916723967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.916759014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.916765928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.916790962 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.916806936 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.917156935 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.917181969 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.917212963 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.917221069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.917247057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.917263985 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.917634964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.917660952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.917692900 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.917701006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.917725086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.917742968 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.918131113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.918154955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.918209076 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.918216944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.918330908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.918663979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.918684959 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.918725967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.918734074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.918755054 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.918772936 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.919116020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.919137001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.919188976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.919198990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.919481039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.919524908 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.919543028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.919584990 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.919593096 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.919608116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.919883013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.919996977 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.920017004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.920053005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.920063019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.920085907 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.920351028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.920531034 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.920552015 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.920593023 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.920600891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.920615911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.920634985 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.921015024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.921036005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.921082973 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.921092033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.921437979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.921489000 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.921506882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.921560049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.921567917 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.921844959 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.921931028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.921948910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.921983957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.921992064 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.922013044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.922278881 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.922441006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.922462940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.922501087 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.922508955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.922533035 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.922547102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.922935963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.922955990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.923003912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.923011065 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.923290968 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.923479080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.923501015 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.923540115 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.923549891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.923819065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.924067974 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.924091101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.924129009 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.924139023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.924154043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.924426079 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.924562931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.924585104 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.924627066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.924633980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.924910069 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.925088882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.925112963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.925153017 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.925162077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.925173998 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.925260067 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.925623894 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.925643921 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.925681114 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.925689936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.925710917 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.925724983 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.926167011 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.926186085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.926224947 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.926233053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.926251888 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.926322937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.926511049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.926529884 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.926574945 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.926584005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.926857948 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.926983118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.927004099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.927037954 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.927046061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.927071095 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.927258968 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.927284002 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.927313089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.927320004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.927335978 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.927364111 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.927541971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.927562952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.927599907 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.927607059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.927618980 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.927644014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.928064108 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.928083897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.928124905 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.928132057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.928158998 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.928173065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.928311110 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.928332090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.928361893 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.928369999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.928395033 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.928407907 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.928679943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.928700924 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.928742886 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.928750992 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.928776026 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.928787947 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.929017067 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.929039955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.929078102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.929085970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.929111004 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.929125071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.929517031 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.929537058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.929588079 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.929595947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.929616928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.929631948 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.929860115 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.929878950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.929914951 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.929922104 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.929946899 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.929961920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.930259943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.930285931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.930329084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.930335999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.930360079 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.930375099 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.930721045 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.930742025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.930789948 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.930797100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.930814028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.930834055 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.931210995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.931231022 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.931279898 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.931288958 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.931308985 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.931325912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.931679010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.931699038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.931744099 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.931752920 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.931777954 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.931790113 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.932147026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.932171106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.932230949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.932244062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.932606936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.932631969 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.932673931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.932684898 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.932699919 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.932718992 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.933187962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.933209896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.933260918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.933271885 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.933286905 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.933305025 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.933631897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.933656931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.933698893 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.933706999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.933721066 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.933741093 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.934111118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.934130907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.934178114 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.934189081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.934201956 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.934226036 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.934395075 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.934415102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.934451103 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.934458971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.934475899 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.934492111 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.934710979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.934731960 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.934775114 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.934782028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.934799910 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.934822083 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.935177088 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.935199976 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.935252905 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.935260057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.935530901 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.935554981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.935605049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.935611963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.935628891 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.935973883 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.936001062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.936043978 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.936053038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.936070919 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.936090946 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.936361074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.936382055 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.936440945 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.936446905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.936460018 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.936636925 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.936666012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.936707973 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.936717987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.936729908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.937263966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.937283039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.937342882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.937355995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.937885046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.937907934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.937949896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.937958956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.937971115 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.938256979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.938276052 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.938328028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.938335896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.938354015 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.938565016 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.938590050 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.938622952 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.938630104 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.938641071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.938673019 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.938977003 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.938996077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.939042091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.939048052 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.939060926 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.939338923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.939363956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.939397097 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.939403057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.939419031 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.939449072 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.939762115 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.939780951 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.939821959 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.939827919 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.939840078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.940079927 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.940109968 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.940138102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.940145969 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.940159082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.940184116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.940510988 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.940530062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.940579891 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.940587044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.940598965 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.940872908 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.940895081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.940932989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.940941095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:57.940954924 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:57.940984964 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.033061981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.033088923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.033150911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.033198118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.033229113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.033247948 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.033293962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.033318043 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.033363104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.033397913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.033442020 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.033469915 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.034138918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034164906 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034224987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034231901 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.034240961 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034259081 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.034261942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034293890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.034324884 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034363031 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034375906 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.034396887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034398079 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.034430027 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034430981 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.034456015 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034461975 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.034485102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.034506083 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.034519911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034540892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034594059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034596920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.034637928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034662008 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034688950 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.034715891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034763098 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.034774065 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034795046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034849882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.034851074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034866095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034885883 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034917116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.034924030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034944057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034945011 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.034969091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.034975052 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034987926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.034996986 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035032034 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035037994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035051107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035052061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035078049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035109997 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035118103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035134077 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035134077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035151958 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035157919 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035175085 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035181046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035212040 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035228968 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035233021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035242081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035269976 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035284042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035291910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035315990 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035324097 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035332918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035340071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035353899 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035379887 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035386086 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035408974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035413980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035429001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035438061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035454035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035465956 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035495996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035501957 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035516024 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035518885 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035542011 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035546064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035554886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035572052 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035608053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035612106 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035626888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035651922 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035676003 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035682917 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035696030 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035716057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035718918 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035731077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035748959 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035773993 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035779953 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035809040 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035809994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035816908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035825014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035856962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035882950 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035888910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035913944 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035927057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035947084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.035985947 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.035993099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036007881 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036009073 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036034107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036035061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036051035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036057949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036082983 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036103010 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036113024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036133051 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036170006 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036175966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036189079 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036190033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036228895 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036293030 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036297083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036303043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036312103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036329985 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036367893 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036375046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036387920 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036387920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036418915 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036420107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036436081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036444902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036478043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036489010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036506891 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036550045 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036556005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036569118 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036570072 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036598921 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036634922 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036642075 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036653996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036665916 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036681890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036686897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036700964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036746025 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036756039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036772013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036781073 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036794901 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036808968 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036828041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036842108 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036848068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036859989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036864042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036883116 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036899090 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036906004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036932945 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036937952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036951065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.036957979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036977053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.036989927 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037012100 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037017107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037031889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037039995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037060976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037061930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037076950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037081957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037112951 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037122011 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037147999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037169933 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037206888 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037214041 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037226915 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037226915 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037246943 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037255049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037288904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037295103 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037348032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037348032 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037348032 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037363052 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037405014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037417889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037425995 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037436962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037463903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037468910 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037483931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037494898 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037527084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037534952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037558079 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037611961 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037619114 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037631035 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037631035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037659883 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037693024 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037699938 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037722111 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037724972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037744999 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037746906 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037760019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037766933 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037810087 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037811041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037822962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037848949 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037874937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037880898 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037893057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037909031 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037929058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037962914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037969112 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.037980080 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.037986994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038005114 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038012981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038027048 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038029909 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038048029 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038078070 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038085938 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038099051 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038115978 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038144112 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038151026 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038162947 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038171053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038197041 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038228035 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038234949 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038245916 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038258076 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038268089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038280010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038307905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038320065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038326979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038348913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038362980 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038393974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038399935 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038413048 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038415909 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038438082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038441896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038458109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038471937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038486958 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038503885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038526058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038546085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038575888 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038583040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038597107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038605928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038616896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038623095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038640022 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038656950 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038676023 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038681030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038701057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038722038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038722992 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038736105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038753033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038774967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038780928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038805962 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038805962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038819075 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038825035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038841009 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038861990 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038867950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038882017 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038896084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038907051 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038913012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038938999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038949966 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.038969040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038985014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.038995981 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039011002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039011955 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039031982 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039036989 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039064884 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039088011 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039093018 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039107084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039133072 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039151907 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039158106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039175034 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039186954 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039201021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039206028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039220095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039227009 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039263010 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039274931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039274931 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039288998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039308071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039330006 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039335966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039350033 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039366007 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039367914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039367914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039380074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039403915 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039419889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039427996 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039442062 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039459944 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039462090 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039482117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039498091 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039504051 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039515972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039544106 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039544106 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039557934 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039580107 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039597988 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039604902 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039635897 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039635897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039644957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039652109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039685965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039695024 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039700985 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039724112 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039743900 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039748907 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039762974 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039778948 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039798021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039815903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039824963 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039824963 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039834976 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039869070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039882898 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039887905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039899111 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039917946 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039925098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039937019 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039942980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.039956093 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.039988041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.040039062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.040065050 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.040117979 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.040121078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.040132046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.040153980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.040178061 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.040184975 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.040206909 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.040215015 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.040291071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.040291071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.040298939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.041299105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.041362047 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.041368961 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.041435957 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.041500092 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.041506052 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.041676998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.041731119 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.041738033 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.041774035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.041794062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.041829109 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.041846991 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.041858912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.041873932 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.041898966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.041928053 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.041934013 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.041956902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.041975975 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.042356968 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.042382956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.042463064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.042476892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.042514086 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.042573929 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.042582035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.042598963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.042651892 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.042659044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.042726994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.042746067 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.042784929 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.042792082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.042810917 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.042814970 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.042836905 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.042861938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.042963028 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.042989016 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.043040037 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.043046951 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.043057919 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.043077946 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.043112040 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.043179989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.043190002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.043498039 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.043534040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.043555021 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.043560982 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.043606997 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.043606997 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.043665886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.043688059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.043721914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.043730021 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.043741941 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.043803930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.043836117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.043862104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.043869972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.043900967 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.043920040 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.043962002 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.043988943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.044018984 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.044025898 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.044038057 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.044133902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.044189930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.044214010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.044249058 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.044258118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.044301987 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.044322968 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.044337988 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.044337988 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.044348001 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.044361115 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.044372082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.044394016 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.044701099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.044816971 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.044830084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.044903040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.044936895 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.044943094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.044956923 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.044965982 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.045022964 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.045028925 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.045090914 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.045111895 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.045150042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.045156956 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.045180082 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.045192003 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.045308113 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.045336962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.045368910 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.045375109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.045388937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.045403004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.045428991 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.045479059 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.045479059 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.045485973 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.045499086 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.045516014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.045530081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.045559883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.045567036 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.045591116 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.045614958 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.045892000 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.045913935 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.045948982 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.045954943 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.045968056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.046025038 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.046053886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.046083927 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.046091080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.046108961 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.046122074 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.046248913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.046268940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.046304941 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.046312094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.046334982 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.046336889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.046344995 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.046354055 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.046387911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.046483040 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.047106981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.047187090 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.047352076 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.047399998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.047421932 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.047426939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.047454119 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.047468901 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.047538042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.047586918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.047620058 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.047625065 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.047636986 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.047714949 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.047765017 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.047770977 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.047797918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.047836065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.047846079 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.047933102 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.047971964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.047975063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.047997952 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048002005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.048015118 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048033953 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048044920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048149109 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.048192024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.048212051 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048228025 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.048240900 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048330069 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048336983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.048362017 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.048407078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.048410892 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048410892 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048434973 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.048461914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048484087 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048567057 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.048604965 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.048625946 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048630953 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.048641920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048665047 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048674107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048712969 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048724890 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.048763037 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.048784018 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048789024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.048810005 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048856974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048887014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.048933983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.048955917 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048960924 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.048986912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.048986912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.049056053 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.049125910 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.049154997 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.049221039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.049280882 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.049293041 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.049323082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.049340010 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.049345970 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.049376011 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.049388885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.049448013 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.049487114 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.049514055 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.049519062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.049546003 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.049570084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.049619913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.049658060 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.049681902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.049686909 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.049731970 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.049731970 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.049779892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.049823999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.049841881 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.049848080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.049869061 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.049879074 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.049885988 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.049974918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.050015926 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.050025940 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.050045013 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.050050020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.050072908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.050086975 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.050143957 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.050200939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.050244093 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.050311089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.050371885 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.050420046 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.050436974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.050445080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.050474882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.050486088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.050545931 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.050589085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.050610065 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.050615072 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.050641060 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.050652027 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.050713062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.050759077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.050780058 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.050785065 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.050801039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.050825119 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.050880909 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.050920010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.050940037 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.050945044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.050973892 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.050992012 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.051045895 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.051086903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.051105022 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.051110983 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.051126003 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.051147938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.051209927 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.051269054 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.051271915 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.051289082 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.051305056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.051321983 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.051331043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.051407099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.051456928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.051476002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.051481962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.051511049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.051517963 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.051585913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.051632881 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.051652908 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.051657915 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.051683903 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.051692963 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.051763058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.051805019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.051826000 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.051831007 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.051851988 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.051872015 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.051934004 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.051973104 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.052032948 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.052037954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.052078009 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.052104950 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.052138090 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.052143097 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.052164078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.052189112 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.052229881 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.052234888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.052325964 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.052333117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.052357912 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.052388906 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.052395105 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.052409887 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.052417040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.052448034 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.052467108 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.052512884 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.052555084 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.052575111 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.052580118 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.052601099 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.052613020 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.052679062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.052723885 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.052725077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.052736044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.052747011 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.052782059 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.052800894 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.052866936 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.052917957 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.052942991 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.052948952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.052970886 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.052985907 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.053040981 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.053086996 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.053086996 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.053106070 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.053112984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.053129911 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.053148031 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.053210020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.053247929 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.053255081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.053262949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.053276062 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.053313017 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.053332090 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.053397894 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.053438902 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.053464890 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.053469896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.053498030 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.053508043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.053550959 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.053590059 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.053612947 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.053618908 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.053636074 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.053654909 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.053718090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.053759098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.053776979 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.053782940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.053798914 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.053817987 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.053880930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.053930044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.053947926 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.053953886 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.053982019 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.053994894 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.054053068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.054099083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.054119110 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.054124117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.054145098 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.054164886 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.054223061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.054261923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.054282904 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.054287910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.054320097 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.054321051 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.054387093 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.054434061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.054454088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.054459095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.054471970 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.054497957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.054557085 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.054599047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.054617882 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.054624081 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.054655075 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.054665089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.054723024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.054852962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.054877043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.054882050 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.054913044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.054980040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.055022001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.055025101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.055039883 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.055047035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.055083036 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.055103064 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.055161953 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.055206060 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.055226088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.055232048 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.055263042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.055272102 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.055334091 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.055375099 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.055401087 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.055406094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.055427074 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.055444002 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.055499077 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.055537939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.055556059 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.055562019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.055593014 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.055602074 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.055669069 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.055713892 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.055737972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.055743933 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.055761099 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.055820942 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.055841923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.055886984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.055902004 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.055912018 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.055948973 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.055969000 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.056031942 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.056077957 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.056098938 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.056103945 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.056134939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.056153059 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.056202888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.056257963 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.056261063 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.056277990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.056308985 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.056329966 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.056401014 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.056442976 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.056463003 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.056468964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.056500912 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.056566954 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.056607962 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.056611061 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.056624889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.056639910 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.056674957 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.056694984 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.056755066 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.056792974 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.056814909 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.056827068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.056840897 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.056921959 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.056967974 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.056979895 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.056994915 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.057030916 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.057049990 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.057117939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.057157040 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.057176113 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.057182074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.057209015 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.057225943 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.057281971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.057328939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.057343960 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.057349920 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.057382107 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.057390928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.057452917 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.057496071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.057513952 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.057519913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.057542086 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.057564974 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.057619095 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.057658911 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.057681084 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.057686090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.057709932 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.057727098 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.057779074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.057821035 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.057842016 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.057847023 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.057862043 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.057888031 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.057945967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.057987928 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.058002949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.058010101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.058042049 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.058109045 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.058151960 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.058233976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.058239937 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.058274031 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.058293104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.058331966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.058346987 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.058360100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.058398962 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.058419943 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.058499098 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.058546066 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.058563948 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.058569908 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.058597088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.058609009 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.058667898 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.058707952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.058727980 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.058732986 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.058743954 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.058767080 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.058767080 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.058831930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.058861971 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.058891058 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.058896065 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.058913946 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.058914900 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.058933973 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.058938980 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.058949947 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.058957100 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.058983088 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.058993101 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059005976 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059031010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059065104 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059068918 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059082031 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059093952 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059118032 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059148073 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059151888 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059165001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059179068 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059187889 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059192896 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059230089 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059228897 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059252024 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059263945 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059283972 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059283972 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059303999 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059309006 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059320927 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059344053 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059344053 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059350967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059361935 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059381962 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059403896 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059408903 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059433937 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059442997 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059462070 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059489965 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059494019 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059505939 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059526920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059778929 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059797049 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059817076 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059822083 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059834003 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059866905 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059870958 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059879065 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059900045 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059919119 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059923887 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059947968 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059948921 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059961081 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.059966087 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059974909 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.059993982 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060025930 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060026884 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060038090 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060059071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060075998 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060081005 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060096025 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060112000 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060115099 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060127020 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060142994 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060164928 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060168982 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060179949 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060199976 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060200930 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060237885 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060235977 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060252905 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060254097 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060298920 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060312986 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060333967 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060369968 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060374022 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060384989 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060385942 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060408115 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060431004 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060436010 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060472012 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060486078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060486078 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060488939 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060504913 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060518026 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060539007 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060554028 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060568094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060585976 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060621977 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060626030 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060636044 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060647964 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060656071 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060678959 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060683966 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060710907 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060720921 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060729027 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060734034 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060764074 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060771942 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060784101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060802937 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060821056 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060826063 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060857058 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060867071 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060872078 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060889959 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060905933 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060910940 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060923100 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060937881 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060944080 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060952902 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.060959101 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.060975075 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.061006069 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.061007977 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.061017990 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.061033964 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.061054945 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.061058998 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.061069965 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.061086893 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.061109066 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.061131001 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.061136007 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.061152935 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.061165094 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.061173916 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.061178923 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.061197042 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.061209917 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.061214924 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.061223984 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.061244965 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.061252117 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.061264992 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.061269999 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.061281919 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.061300039 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.061341047 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:20:58.061372042 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.062946081 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.062964916 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.065215111 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.072504044 CET	49732	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:20:58.072525978 CET	443	49732	156.146.36.23	192.168.2.4
Mar 12, 2024 10:21:05.193526983 CET	49733	80	192.168.2.4	156.146.36.23
Mar 12, 2024 10:21:05.280757904 CET	80	49733	156.146.36.23	192.168.2.4
Mar 12, 2024 10:21:05.280858994 CET	49733	80	192.168.2.4	156.146.36.23
Mar 12, 2024 10:21:05.281706095 CET	49733	80	192.168.2.4	156.146.36.23
Mar 12, 2024 10:21:05.368838072 CET	80	49733	156.146.36.23	192.168.2.4
Mar 12, 2024 10:21:05.369407892 CET	80	49733	156.146.36.23	192.168.2.4
Mar 12, 2024 10:21:05.371946096 CET	49734	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:21:05.371983051 CET	443	49734	156.146.36.23	192.168.2.4
Mar 12, 2024 10:21:05.372044086 CET	49734	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:21:05.390336037 CET	49733	80	192.168.2.4	156.146.36.23
Mar 12, 2024 10:21:05.425419092 CET	49734	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:21:05.425441027 CET	443	49734	156.146.36.23	192.168.2.4
Mar 12, 2024 10:21:05.434390068 CET	49734	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:21:05.478065968 CET	80	49733	156.146.36.23	192.168.2.4
Mar 12, 2024 10:21:05.478197098 CET	49733	80	192.168.2.4	156.146.36.23
Mar 12, 2024 10:21:05.480233908 CET	443	49734	156.146.36.23	192.168.2.4
Mar 12, 2024 10:21:05.620126009 CET	443	49734	156.146.36.23	192.168.2.4
Mar 12, 2024 10:21:05.620207071 CET	49734	443	192.168.2.4	156.146.36.23
Mar 12, 2024 10:21:05.620207071 CET	49734	443	192.168.2.4	156.146.36.23

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 12, 2024 10:20:56.065789938 CET	50875	53	192.168.2.4	1.1.1.1
Mar 12, 2024 10:20:56.170589924 CET	53	50875	1.1.1.1	192.168.2.4
Mar 12, 2024 10:21:02.440476894 CET	49823	53	192.168.2.4	1.1.1.1
Mar 12, 2024 10:21:05.092927933 CET	50769	53	192.168.2.4	1.1.1.1
Mar 12, 2024 10:21:05.185408115 CET	53	50769	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Mar 12, 2024 10:20:56.065789938 CET	192.168.2.4	1.1.1.1	0xdf5a	Standard query (0)	static.adguardvpn.com	A (IP address)	IN (0x0001)	false
Mar 12, 2024 10:21:02.440476894 CET	192.168.2.4	1.1.1.1	0x95c7	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Mar 12, 2024 10:21:05.092927933 CET	192.168.2.4	1.1.1.1	0x3dd6	Standard query (0)	static.adguard.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Mar 12, 2024 10:20:56.170589924 CET	1.1.1.1	192.168.2.4	0xdf5a	No error (0)	static.adguardvpn.com	1523296349.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 12, 2024 10:20:56.170589924 CET	1.1.1.1	192.168.2.4	0xdf5a	No error (0)	1523296349.rsc.cdn77.org		156.146.36.23	A (IP address)	IN (0x0001)	false
Mar 12, 2024 10:20:56.170589924 CET	1.1.1.1	192.168.2.4	0xdf5a	No error (0)	1523296349.rsc.cdn77.org		89.187.177.16	A (IP address)	IN (0x0001)	false
Mar 12, 2024 10:21:02.528441906 CET	1.1.1.1	192.168.2.4	0x95c7	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Mar 12, 2024 10:21:05.185408115 CET	1.1.1.1	192.168.2.4	0x3dd6	No error (0)	static.adguard.com	1625341327.rsc.cdn77.org		CNAME (Canonical name)	IN (0x0001)	false
Mar 12, 2024 10:21:05.185408115 CET	1.1.1.1	192.168.2.4	0x3dd6	No error (0)	1625341327.rsc.cdn77.org		156.146.36.23	A (IP address)	IN (0x0001)	false
Mar 12, 2024 10:21:05.185408115 CET	1.1.1.1	192.168.2.4	0x3dd6	No error (0)	1625341327.rsc.cdn77.org		89.187.177.17	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

static.adguardvpn.com

static.adguard.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49733	156.146.36.23	80	7228	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe

Timestamp	Bytes transferred	Direction	Data
Mar 12, 2024 10:21:05.281706095 CET	87	OUT	GET /installer.v1.0.json HTTP/1.1 Host: static.adguard.com Connection: Keep-Alive
Mar 12, 2024 10:21:05.369407892 CET	1124	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 12 Mar 2024 09:21:05 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://static.adguard.com/installer.v1.0.json Server: CDN77-Turbo X-77-NZT: EQgBnJIkFgAA X-77-NZT-Ray: 1e192d08437a34ba811ef065e50b7413 X-77-POP: newyorkUSNY X-77-Cache: MISS Data Raw: 33 30 34 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 62 61 73 65 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 65 72 72 6f 72 2e 63 2e 63 64 6e 37 37 2e 6f 72 67 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 61 75 74 68 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 28 63 29 20 32 30 32 33 20 43 44 4e 37 37 22 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 73 73 2f 6d 61 69 6e 2e 63 73 73 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 69 6d 67 2f 66 61 76 69 63 6f 6e 2e 69 63 6f 22 20 2f 3e 0a 0a 20 20 20 20 3c 74 69 74 6c 65 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 30 64 35 32 38 34 3b 20 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 20 63 6c 61 73 73 3d 22 48 65 61 64 65 72 2d 77 72 61 70 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 73 6d 61 6c 6c 20 63 6c 61 73 73 3d 22 48 65 61 64 65 72 2d 65 72 72 6f 72 4e 75 6d 62 65 72 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 33 30 31 20 52 65 64 69 72 65 63 74 3c 2f 73 6d 61 6c 6c 3e 3c 62 72 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 0a 20 20 20 20 20 20 20 20 3c 2f 68 31 3e 0a 20 20 20 20 20 20 20 20 3c 70 20 63 6c 61 73 73 3d 22 48 65 61 64 65 72 2d 64 65 73 63 72 69 70 74 69 6f 6e 22 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 54 68 69 73 20 72 65 73 6f 75 72 63 65 20 68 61 73 20 62 65 65 6e 20 70 65 72 6d 61 6e 65 6e 74 6c 79 20 6d 6f 76 65 64 20 74 6f 20 61 20 6e 65 77 20 6c 6f 63 61 74 69 6f 6e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 304<!DOCTYPE html><head> <base href="https://error.c.cdn77.org/" target="_blank"> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="author" content="(c) 2023 CDN77"> <meta name="viewport" content="width=device-width, initial-scale=1"> <link rel="stylesheet" href="css/main.css"> <link rel="shortcut icon" href="img/favicon.ico" /> <title>Moved Permanently</title></head><body style="background-color: #0d5284; color: #fff;" class="Header-wrap"> <h1> <small class="Header-errorNumber"> 301 Redirect</small><br> Moved Permanently </h1> <p class="Header-description"> This resource has been permanently moved to a new location.</p></body>0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	156.146.36.23	443	5004	C:\Users\user\Desktop\TsU2RShnl7.exe

Timestamp	Bytes transferred	Direction	Data
2024-03-12 09:20:56 UTC	107	OUT	GET /windows/installer.exe HTTP/1.1 User-Agent: AdGuard VPN Web Installer Host: static.adguardvpn.com
2024-03-12 09:20:56 UTC	621	IN	HTTP/1.1 200 OK Date: Tue, 12 Mar 2024 09:20:56 GMT Content-Type: application/x-msdos-program Content-Length: 27862776 Connection: close Last-Modified: Mon, 19 Feb 2024 16:43:27 GMT x-rgw-object-type: Normal ETag: "0f6253c9f6113590ac12e665670e5870" x-amz-request-id: tx00000036678a76b5c9a68-0065eecdd0-2bbae03-prg X-77-NZT: A5ySJBY3Nzfe8YMAAJySO983Nzf/AhwAAG09Wg3+C6EA X-77-NZT-Ray: 1e192d08ef7bbd7f781ef06592ba3321 X-Accel-Expires: @1710237346 X-Accel-Date: 1710201479 X-77-Cache: HIT X-77-Age: 40947 Server: CDN77-Turbo X-Cache: REVALIDATED X-Age: 33777 X-77-POP: newyorkUSNY Accept-Ranges: bytes
2024-03-12 09:20:56 UTC	15763	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 39 0a 6f fb 7d 6b 01 a8 7d 6b 01 a8 7d 6b 01 a8 c9 f7 f0 a8 77 6b 01 a8 c9 f7 f2 a8 00 6b 01 a8 c9 f7 f3 a8 65 6b 01 a8 2f 03 05 a9 6e 6b 01 a8 2f 03 02 a9 69 6b 01 a8 2f 03 04 a9 56 6b 01 a8 74 13 82 a8 78 6b 01 a8 74 13 92 a8 6c 6b 01 a8 7d 6b 00 a8 28 6a 01 a8 eb 02 04 a9 36 6b 01 a8 eb 02 fe a8 7c 6b 01 a8 7d 6b 96 a8 7f 6b 01 a8 eb 02 03 a9 7c 6b 01 a8 52 69 63 68 7d 6b 01 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$9o}k}k}kwkkek/nk/ik/Vktxktlk}k(j6k\|k}kk\|kRich}k
2024-03-12 09:20:56 UTC	16384	IN	Data Raw: 40 00 80 56 68 4c 02 00 00 68 8c aa 44 00 e8 14 ef ff ff 68 fc ae 44 00 e9 de 00 00 00 ff b7 b0 04 00 00 50 ff 15 a8 a1 44 00 85 c0 75 38 ff 15 f4 a0 44 00 8b f0 85 f6 7e 0b 0f b7 f6 81 ce 00 00 07 80 85 f6 78 05 be 05 40 00 80 56 68 51 02 00 00 68 8c aa 44 00 e8 cb ee ff ff 68 38 af 44 00 e9 95 00 00 00 57 68 9e 45 40 00 e8 5d b5 03 00 57 ff 75 08 e8 c1 9e 01 00 8b f0 85 f6 79 07 68 d8 ad 44 00 eb 74 6a 01 e8 f0 ca 03 00 8d 47 18 50 8d 87 f8 00 00 00 50 8d 45 f8 50 8d 45 fc 50 8d 87 b8 00 00 00 50 8d 87 00 01 00 00 50 8d 87 88 00 00 00 50 8d 87 b8 02 00 00 50 8d 87 c0 02 00 00 50 8d 87 a8 02 00 00 50 8d 87 d8 03 00 00 50 ff b7 b4 04 00 00 ff b7 b0 04 00 00 ff b7 98 04 00 00 e8 68 86 01 00 53 53 8b f0 e8 dc b4 03 00 85 f6 79 0d 68 7c af 44 00 56 e8 75 b0 Data Ascii: @VhLhDhDPDu8D~x@VhQhDh8DWhE@]WuyhDtjGPPEPEPPPPPPPPhSSyh\|DVu
2024-03-12 09:20:56 UTC	16384	IN	Data Raw: 1c 89 08 eb 05 ba 57 00 07 80 8b c2 5d c2 18 00 90 c8 88 40 00 fd 88 40 00 15 89 40 00 29 89 40 00 3d 89 40 00 4d 89 40 00 62 89 40 00 72 89 40 00 81 89 40 00 fd 88 40 00 15 89 40 00 29 89 40 00 3d 89 40 00 4d 89 40 00 62 89 40 00 72 89 40 00 81 89 40 00 55 8b ec 51 53 56 8b 35 04 a1 44 00 33 db 57 8b 7d 08 8b c7 ff 75 0c c1 e8 11 83 e0 01 89 45 fc ff d6 ff 75 10 89 45 08 ff d6 8b f0 81 ff 0a 00 03 00 7f 5f 81 ff 05 00 03 00 7d 2c 81 ff 05 00 01 00 7c 61 81 ff 0a 00 01 00 7e 1c 81 ff 0b 00 01 00 0f 84 96 00 00 00 81 ff 0c 00 01 00 74 67 81 ff 0d 00 01 00 eb 3b 56 ff 75 10 ff 75 08 ff 75 0c ff 75 fc 6a 7f ff 15 34 a1 44 00 ff 75 14 99 53 6a 02 52 50 57 e8 2c fe ff ff 8b d8 e9 97 00 00 00 81 ef 0b 00 03 00 74 53 83 ef 01 74 27 83 ef 01 74 07 bb 57 00 07 80 Data Ascii: W]@@@)@=@M@b@r@@@@)@=@M@b@r@@UQSV5D3W}uEuE_},\|a~tg;Vuuuuj4DuSjRPW,tSt'tW
2024-03-12 09:20:56 UTC	16384	IN	Data Raw: 83 c4 0c eb 14 68 98 eb 44 00 eb 05 68 6c eb 44 00 56 e8 5f 31 03 00 59 59 5f 8b c6 5e 5b c9 c2 08 00 55 8b ec 56 8b 75 08 8b 06 85 c0 74 66 53 33 db 39 5e 04 76 57 33 c0 89 45 08 57 8b 3e 03 f8 83 7f 0c 00 74 0d ff 77 0c ff 15 e0 a0 44 00 83 67 0c 00 83 3f 00 74 07 ff 37 e8 6f 5d ff ff 83 7f 08 00 74 08 ff 77 08 e8 61 5d ff ff 83 7f 04 00 74 08 ff 77 04 e8 53 5d ff ff 8b 45 08 43 83 c0 10 89 45 08 3b 5e 04 72 b2 8b 06 5f 50 e8 7d 70 ff ff 5b 83 26 00 83 66 04 00 5e 5d c2 04 00 55 8b ec 83 ec 0c 56 57 8d 45 f4 33 ff 50 68 90 ea 44 00 ff 75 0c 89 7d f4 89 7d fc 89 7d f8 e8 2b 67 03 00 8b f0 85 f6 79 12 68 a0 ea 44 00 56 e8 a0 30 03 00 59 59 e9 f0 00 00 00 8b 45 f4 8d 55 f8 52 50 8b 08 ff 51 20 8b f0 85 f6 79 07 68 c0 ea 44 00 eb d9 8b 45 f8 85 c0 0f 84 cb Data Ascii: hDhlDV_1YY_^[UVutfS39^vW3EW>twDg?t7o]twa]twS]ECE;^r_P}p[&f^]UVWE3PhDu}}}+gyhDV0YYEURPQ yhDE
2024-03-12 09:20:56 UTC	16384	IN	Data Raw: ff ff 39 5e 70 74 08 ff 76 70 e8 c0 1d ff ff 39 5e 74 74 08 ff 76 74 e8 b3 1d ff ff 39 5e 78 74 08 ff 76 78 e8 a6 1d ff ff 39 5e 7c 74 08 ff 76 7c e8 99 1d ff ff 8b 86 80 00 00 00 85 c0 74 06 50 e8 89 1d ff ff 8b 86 84 00 00 00 85 c0 74 06 50 e8 79 1d ff ff 8b 86 a0 00 00 00 85 c0 74 06 50 e8 69 1d ff ff 8b 86 a4 00 00 00 85 c0 74 06 50 e8 59 1d ff ff 8b 86 a8 00 00 00 85 c0 74 06 50 e8 49 1d ff ff 8b 86 ac 00 00 00 85 c0 74 06 50 e8 39 1d ff ff 8b 86 b0 00 00 00 85 c0 74 06 50 e8 29 1d ff ff 8b 86 94 00 00 00 85 c0 74 79 39 9e 98 00 00 00 76 69 33 ff 8b 14 38 8b c8 85 d2 74 0e 52 e8 06 1d ff ff 8b 86 94 00 00 00 8b c8 8b 54 39 04 85 d2 74 0e 52 e8 f0 1c ff ff 8b 86 94 00 00 00 8b c8 8b 54 39 08 85 d2 74 0e 52 e8 da 1c ff ff 8b 86 94 00 00 00 8b c8 8b 54 Data Ascii: 9^ptvp9^ttvt9^xtvx9^\|tv\|tPtPytPitPYtPItP9tP)ty9vi38tRT9tRT9tRT
2024-03-12 09:20:56 UTC	16384	IN	Data Raw: fc 51 ff 77 04 50 ff 75 08 ff 15 fc a1 44 00 85 c0 75 35 ff 15 f4 a0 44 00 8b f0 85 f6 7e 0b 0f b7 f6 81 ce 00 00 07 80 85 f6 78 05 be 05 40 00 80 56 68 27 03 00 00 68 a4 33 45 00 e8 e6 ee fe ff 68 dc 3a 45 00 eb 9b c7 47 08 01 00 00 00 83 7f 08 00 75 0e 83 7f 0c 00 74 08 ff 77 0c e8 ae f0 fe ff 5f 8b c6 5e 5b c9 c2 08 00 55 8b ec 51 51 56 57 8d 45 fc 33 ff 50 8d 45 f8 89 7d f8 50 ff 75 14 89 7d fc ff 75 10 ff 75 0c e8 aa fb ff ff 8b f0 85 f6 79 07 68 40 3a 45 00 eb 61 89 7d 14 39 7d fc 76 61 6a 00 8d 45 14 50 8b 45 fc 2b c7 50 ff 75 f8 ff 75 08 ff 15 3c a1 44 00 85 c0 74 0a 03 7d 14 3b 7d fc 72 dc eb 3b ff 15 f4 a0 44 00 8b f0 85 f6 7e 0b 0f b7 f6 81 ce 00 00 07 80 85 f6 78 05 be 05 40 00 80 56 68 f0 02 00 00 68 a4 33 45 00 e8 2d ee fe ff 68 68 3a 45 00 Data Ascii: QwPuDu5D~x@Vh'h3Eh:EGutw_^[UQQVWE3PE}Pu}uuyh@:Ea}9}vajEPE+Puu<Dt};}r;D~x@Vhh3E-hh:E
2024-03-12 09:20:56 UTC	16384	IN	Data Raw: 78 aa 46 00 57 68 e0 53 45 00 ff 75 fc e8 b0 a4 fe ff 8b d8 85 db 79 0f 68 74 57 45 00 68 9c 62 45 00 e9 5c 01 00 00 57 e8 3e a2 fe ff 8b d8 85 db 79 0f 68 74 57 45 00 68 d8 62 45 00 e9 41 01 00 00 a1 7c aa 46 00 85 c0 75 68 bf 7c aa 46 00 57 56 68 20 63 45 00 68 38 53 45 00 e8 77 c6 02 00 8b d8 85 db 79 12 68 3c 63 45 00 53 e8 04 71 02 00 59 59 e9 13 01 00 00 39 35 7c aa 46 00 74 13 57 e8 e4 a1 fe ff 8b d8 85 db 79 21 68 70 63 45 00 eb d8 56 ff 35 78 aa 46 00 57 e8 6a 98 fe ff 8b d8 85 db 79 07 68 c8 63 45 00 eb be a1 7c aa 46 00 39 75 0c 75 05 a1 78 aa 46 00 56 8b 75 10 50 56 e8 43 98 fe ff 8b d8 85 db 79 0a 68 74 57 45 00 e9 a6 00 00 00 8d 45 f8 50 ff 36 ff 35 78 aa 46 00 e8 67 a3 fe ff 8b d8 85 db 79 0a 68 50 64 45 00 e9 73 ff ff ff 33 db 83 7d f8 02 Data Ascii: xFWhSEuyhtWEhbE\W>yhtWEhbEA\|Fuh\|FWVh cEh8SEwyh<cESqYY95\|FtWy!hpcEV5xFWjyhcE\|F9uuxFVuPVCyhtWEEP65xFgyhPdEs3}
2024-03-12 09:20:56 UTC	16384	IN	Data Raw: 0e 00 07 80 56 68 f0 04 00 00 68 b0 6e 45 00 e8 13 6f fe ff 68 1c 7f 45 00 e9 63 ff ff ff 33 c0 89 45 08 8b 45 f8 85 c0 74 32 8b d3 89 5d f0 52 8d 45 fc 50 ff 77 04 ff 77 0c e8 d1 25 02 00 8b f0 85 f6 78 6e 8b 4d 08 8b 55 f0 41 8b 45 f8 83 c2 04 89 4d 08 89 55 f0 3b c8 72 d3 89 45 e8 89 5d ec 8b 45 0c 8d 4d e0 ff 70 04 51 ff 10 8b 4d 10 89 01 83 7d f4 00 74 08 ff 75 f4 e8 4e 5d fe ff 85 db 74 25 8b 45 f8 85 c0 74 18 33 ff 83 3c bb 00 74 0b ff 34 bb e8 33 5d fe ff 8b 45 f8 47 3b f8 72 ea 53 e8 67 70 fe ff 5f 8b c6 5e 5b c9 c2 0c 00 8b 45 08 50 68 48 7f 45 00 56 e8 b4 30 02 00 83 c4 0c eb ac 8d 45 e8 c7 45 e0 01 00 00 00 50 8d 45 fc 50 ff 77 04 ff 77 0c e8 d6 24 02 00 8b f0 85 f6 79 0a 68 cc 7e 45 00 e9 90 fe ff ff 8d 45 f4 50 8d 45 fc 50 ff 77 04 ff 77 0c Data Ascii: VhhnEohEc3EEt2]REPww%xnMUAEMU;rE]EMpQM}tuN]t%Et3<t43]EG;rSgp_^[EPhHEV0EEPEPww$yh~EEPEPww
2024-03-12 09:20:56 UTC	16384	IN	Data Raw: 75 fc 5e eb 53 57 8d 45 fc 50 ff 75 10 ff 75 0c ff 73 3c ff 15 3c a1 44 00 85 c0 75 3b ff 15 f4 a0 44 00 8b f8 85 ff 7e 0b 0f b7 ff 81 cf 00 00 07 80 85 ff 78 05 bf 05 40 00 80 57 68 04 03 00 00 68 28 9d 45 00 e8 dc 2e fe ff 68 94 a1 45 00 57 e8 20 f1 01 00 59 59 89 7b 30 85 ff 5f 5b 79 05 83 c8 ff c9 c3 8b 45 fc c9 c3 55 8b ec 83 ec 10 56 57 8b 7d 08 33 f6 89 75 f0 89 75 f4 89 75 f8 8b 47 2c 48 89 75 fc 83 e8 01 74 3a 83 e8 01 0f 84 80 00 00 00 48 83 e8 01 74 24 be 9f 13 07 80 56 68 96 02 00 00 68 28 9d 45 00 e8 76 2e fe ff 68 d8 9f 45 00 56 e8 ba f0 01 00 59 59 eb 56 be 04 40 00 80 eb 4f 8b 4d 0c 8d 45 f0 50 0f b7 41 1a 50 0f b7 41 18 50 ff 15 5c a2 44 00 85 c0 74 21 8d 45 f8 50 8d 45 f0 50 ff 15 58 a2 44 00 85 c0 74 0f 8d 45 f8 50 50 50 ff 77 3c ff 15 Data Ascii: u^SWEPuus<<Du;D~x@Whh(E.hEW YY{0_[yEUVW}3uuuG,Hut:Ht$Vhh(Ev.hEVYYV@OMEPAPAP\Dt!EPEPXDtEPPPw<
2024-03-12 09:20:56 UTC	16384	IN	Data Raw: 83 65 08 00 89 87 c0 00 00 00 85 c0 0f 84 50 01 00 00 33 c9 89 4d ec 8b 87 bc 00 00 00 03 c1 89 45 0c 8d 45 fc 6a 00 50 ff 75 f8 e8 1f e7 01 00 8b f0 85 f6 0f 88 a3 01 00 00 ff 75 0c 68 64 bb 44 00 ff 75 fc e8 80 e1 01 00 8b f0 85 f6 0f 88 7f 01 00 00 8b 45 0c 83 c0 04 50 68 78 ad 45 00 ff 75 fc e8 62 e1 01 00 8b f0 81 fe 90 04 07 80 74 08 85 f6 0f 88 1d 01 00 00 8b 45 0c 83 c0 08 50 68 c0 ad 45 00 ff 75 fc e8 3c e1 01 00 8b f0 81 fe 90 04 07 80 74 08 85 f6 0f 88 01 01 00 00 8b 45 0c 83 c0 0c 50 68 0c ae 45 00 ff 75 fc e8 16 e1 01 00 8b f0 81 fe 90 04 07 80 74 08 85 f6 0f 88 e5 00 00 00 8b 45 0c 83 c0 10 50 68 58 ae 45 00 ff 75 fc e8 f0 e0 01 00 8b f0 81 fe 90 04 07 80 74 08 85 f6 0f 88 c9 00 00 00 8b 45 0c 83 c0 14 50 68 b8 ae 45 00 ff 75 fc e8 ca e0 01 Data Ascii: eP3MEEjPuuhdDuEPhxEubtEPhEu<tEPhEutEPhXEutEPhEu

Target ID:	0
Start time:	10:20:54
Start date:	12/03/2024
Path:	C:\Users\user\Desktop\TsU2RShnl7.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\TsU2RShnl7.exe
Imagebase:	0xef0000
File size:	116'256 bytes
MD5 hash:	5FD249A523F8006DAE95752B5CF9BF49
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:20:58
Start date:	12/03/2024
Path:	C:\Users\user\AppData\Local\Temp\adguard\setup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\adguard\setup.exe "AID=31220"
Imagebase:	0xbd0000
File size:	27'862'776 bytes
MD5 hash:	0F6253C9F6113590AC12E665670E5870
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	10:20:58
Start date:	12/03/2024
Path:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\adguard\setup.exe" -burn.filehandle.attached=708 -burn.filehandle.self=744 "AID=31220
Imagebase:	0x1e0000
File size:	3'149'056 bytes
MD5 hash:	BCAB2557997868A7B0E6DFE214A48969
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000002.00000002.4135043337.0000000006632000.00000002.00000001.01000000.00000011.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000002.00000002.4137906412.0000000006E82000.00000002.00000001.01000000.00000013.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000002.00000002.4138160484.0000000006F22000.00000002.00000001.01000000.00000014.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000002.00000002.4136698136.0000000006B52000.00000002.00000001.01000000.00000012.sdmp, Author: Joe Security
Antivirus matches:	Detection: 0%, ReversingLabs Detection: 0%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	5.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.9%
Total number of Nodes:	1712
Total number of Limit Nodes:	11

Executed Functions

Function 00EF8170 Relevance: 91.6, APIs: 45, Strings: 7, Instructions: 599
memorywindowthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00EF818A
strlen.MSVCRT ref: 00EF819E
HeapAlloc.KERNEL32 ref: 00EF81B9
memchr.MSVCRT ref: 00EF8207
memchr.MSVCRT ref: 00EF8226
memchr.MSVCRT ref: 00EF8261
memchr.MSVCRT ref: 00EF82AC
HeapAlloc.KERNEL32 ref: 00EF8308
HeapFree.KERNEL32 ref: 00EF83A5
GetLastError.KERNEL32 ref: 00EF8403

Part of subcall function 00EF9B84: strlen.MSVCRT ref: 00EF9B91

HeapAlloc.KERNEL32 ref: 00EF845C
GdiplusStartup.GDIPLUS ref: 00EF84AF
GetCurrentThreadId.KERNEL32 ref: 00EF84C0
GetDC.USER32 ref: 00EF84CD
GetDeviceCaps.GDI32 ref: 00EF84E5
ReleaseDC.USER32 ref: 00EF84FD
GetModuleHandleW.KERNEL32 ref: 00EF85BA
LoadIconW.USER32 ref: 00EF85DD
LoadCursorW.USER32 ref: 00EF85FA
RegisterClassExW.USER32(00000000), ref: 00EF8612
SendMessageW.USER32 ref: 00EF8690
SendMessageW.USER32 ref: 00EF86B1
SetWindowLongW.USER32(00000000,00000000), ref: 00EF86EF

Part of subcall function 00EFB104: GlobalAlloc.KERNEL32 ref: 00EFB132
Part of subcall function 00EFB104: GlobalLock.KERNEL32 ref: 00EFB148
Part of subcall function 00EFB104: GlobalFree.KERNEL32 ref: 00EFB15B

ShowWindow.USER32 ref: 00EF87B1

Part of subcall function 00EFB2AC: GetDC.USER32 ref: 00EFB2C4
Part of subcall function 00EFB2AC: CreateCompatibleDC.GDI32 ref: 00EFB2D1
Part of subcall function 00EFB2AC: SelectObject.GDI32 ref: 00EFB2F0
Part of subcall function 00EFB2AC: GdipCreateFromHDC.GDIPLUS ref: 00EFB351
Part of subcall function 00EFB2AC: GdipCreateSolidFill.GDIPLUS ref: 00EFB385
Part of subcall function 00EFB2AC: GdipFillRectangleI.GDIPLUS ref: 00EFB3BB
Part of subcall function 00EFB2AC: GdipDeleteGraphics.GDIPLUS(?,?,?,00EFB642), ref: 00EFB3DA
Part of subcall function 00EFB2AC: CreateCompatibleDC.GDI32(00000000), ref: 00EFB3E6

Part of subcall function 00EF929C: HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00EF87C3,00000000), ref: 00EF93A1
Part of subcall function 00EF929C: HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00EF93BE

GetLastError.KERNEL32(00000000,00000000), ref: 00EF87C9

Part of subcall function 00EF93D8: GetLocaleInfoW.KERNEL32 ref: 00EF941D
Part of subcall function 00EF93D8: GetWindowLongW.USER32 ref: 00EF945E
Part of subcall function 00EF93D8: SetWindowLongW.USER32 ref: 00EF9482
Part of subcall function 00EF93D8: ShowWindow.USER32 ref: 00EF9514
Part of subcall function 00EF93D8: SendMessageW.USER32(00000000,00000000), ref: 00EF955D
Part of subcall function 00EF93D8: SendMessageW.USER32 ref: 00EF9588

CreateThread.KERNEL32(?,?,00000000,00000000), ref: 00EF8821
KiUserCallbackDispatcher.NTDLL(00000030), ref: 00EF8859
GetParent.USER32 ref: 00EF8890
TranslateAcceleratorW.USER32 ref: 00EF88DD
TranslateMessage.USER32 ref: 00EF88F1
DispatchMessageW.USER32 ref: 00EF88FB

Part of subcall function 00EFB220: GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00EFB242
Part of subcall function 00EFB220: GdipGetImageWidth.GDIPLUS ref: 00EFB265
Part of subcall function 00EFB220: GdipGetImageHeight.GDIPLUS ref: 00EFB28A

Part of subcall function 00EFAE88: SetWindowPos.USER32 ref: 00EFAEEB

Part of subcall function 00EFB104: GlobalUnlock.KERNEL32 ref: 00EFB177
Part of subcall function 00EFB104: CreateStreamOnHGlobal.OLE32(00000000), ref: 00EFB193
Part of subcall function 00EFB104: GlobalFree.KERNEL32 ref: 00EFB1A6

WaitForSingleObject.KERNEL32 ref: 00EF8929
GetExitCodeThread.KERNEL32 ref: 00EF893F
CloseHandle.KERNEL32(00000000,00000000), ref: 00EF894A
DeleteObject.GDI32 ref: 00EF8974
DeleteObject.GDI32(00000001), ref: 00EF8985
GdiplusShutdown.GDIPLUS(00000000), ref: 00EF8996
GetModuleHandleW.KERNEL32(00000000,00000000), ref: 00EF89AC
UnregisterClassW.USER32 ref: 00EF89BE
HeapFree.KERNEL32(00000000), ref: 00EF89E9
HeapFree.KERNEL32 ref: 00EF8A2A
HeapFree.KERNEL32 ref: 00EF8A46
HeapFree.KERNEL32 ref: 00EF8A62
HeapFree.KERNEL32 ref: 00EF8A7E
HeapFree.KERNEL32 ref: 00EF8AB6

Strings

https_url, xrefs: 00EF8376
0, xrefs: 00EF85AC
setup_args, xrefs: 00EF8328
X, xrefs: 00EF84DA
http_url, xrefs: 00EF8352
ADGUARD_WI_WNDCLASS, xrefs: 00EF85CB, 00EF89B7
AdGuard VPN Web Installer, xrefs: 00EF8645

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: Heap$Free$CreateGdip$GlobalMessageWindow$AllocObjectSendmemchr$DeleteHandleLongThread$ClassCompatibleErrorFillFromGdiplusImageLastLoadModuleShowTranslatestrlen$AcceleratorBitmapCallbackCapsCloseCodeCurrentCursorDeviceDispatchDispatcherExitGraphicsHeightIconInfoLocaleLockParentProcessRectangleRegisterReleaseSelectShutdownSingleSolidStartupStreamUnlockUnregisterUserWaitWidth
String ID: 0$ADGUARD_WI_WNDCLASS$AdGuard VPN Web Installer$X$http_url$https_url$setup_args
API String ID: 4084662147-2100270031
Opcode ID: e1bc3f1b91bbff8a8361840e300d7cf8c97acd2caaf8714fd0f1f413cf5c867b
Instruction ID: 5fee74efa2092c44520ec1bb4e266b1160677afa5ebe7d29e825997d5cf278b2
Opcode Fuzzy Hash: e1bc3f1b91bbff8a8361840e300d7cf8c97acd2caaf8714fd0f1f413cf5c867b
Instruction Fuzzy Hash: 934238B09083098FD700EFA9D98876EBBF5FF84304F10952DE998AB364DB749849DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EF8E34 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 218
networkfilememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EF9F00: DeleteFileW.KERNEL32 ref: 00EF9F3A
Part of subcall function 00EF9F00: HeapFree.KERNEL32 ref: 00EF9F59

Part of subcall function 00EF9DB8: CreateFileW.KERNEL32 ref: 00EF9EB6
Part of subcall function 00EF9DB8: HeapFree.KERNEL32 ref: 00EF9EE5

GetLastError.KERNEL32 ref: 00EF8E5C
InternetOpenW.WININET ref: 00EF8F1E
InternetOpenUrlW.WININET ref: 00EF8F76
InternetReadFile.WININET ref: 00EF904D
WriteFile.KERNEL32 ref: 00EF9084
RtlFreeHeap.NTDLL ref: 00EF90D9
InternetCloseHandle.WININET ref: 00EF90EB
InternetCloseHandle.WININET ref: 00EF90F1
GetLastError.KERNEL32 ref: 00EF9103

Part of subcall function 00EF8CD8: HeapAlloc.KERNEL32 ref: 00EF8D1C

FindCloseChangeNotification.KERNEL32 ref: 00EF9130

Strings

AdGuard VPN Web Installer, xrefs: 00EF8F17
https://, xrefs: 00EF8F34

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: Internet$FileHeap$CloseFree$ErrorHandleLastOpen$AllocChangeCreateDeleteFindNotificationReadWrite
String ID: AdGuard VPN Web Installer$https://
API String ID: 1769431130-2703855203
Opcode ID: f9ec59d6ae62fb32008e7bc1859b6a656a582382c93220f0114bebbf46a297bf
Instruction ID: 4be5ac9963c5fc6a3c36e833b3834d1b71b24f3aef11ceda2c5dba75a11bbd41
Opcode Fuzzy Hash: f9ec59d6ae62fb32008e7bc1859b6a656a582382c93220f0114bebbf46a297bf
Instruction Fuzzy Hash: 28916C70A043098FDB10EFA9D9887AEBBF1BF84314F109629E694E7291DB75D805CF52

Uniqueness

Uniqueness Score: -1.00%

Function 00EF117C Relevance: 19.7, APIs: 13, Instructions: 199
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00EF11C7
SetUnhandledExceptionFilter.KERNEL32 ref: 00EF1248
__p__acmdln.MSVCRT ref: 00EF1271
malloc.MSVCRT ref: 00EF12FB
strlen.MSVCRT ref: 00EF132B
malloc.MSVCRT ref: 00EF1336
memcpy.MSVCRT ref: 00EF134C
GetStartupInfoA.KERNEL32 ref: 00EF1443

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__acmdlnmemcpystrlen
String ID:
API String ID: 1672962128-0
Opcode ID: 05fff066f72acfea0bbd54a9a03b1be71886b7b593b11b3df60f603c8ab39542
Instruction ID: 3a0ed7fe5926d699b1efed18fab8724314abb6df4425dc4e1aa4bae9d2f48920
Opcode Fuzzy Hash: 05fff066f72acfea0bbd54a9a03b1be71886b7b593b11b3df60f603c8ab39542
Instruction Fuzzy Hash: BD818CB190824CCFEB10EFA4D985379BBE1FB44304F109469EB84A7361D735A884EB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EF13D1 Relevance: 12.1, APIs: 8, Instructions: 108
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetUnhandledExceptionFilter.KERNEL32 ref: 00EF1248
__p__acmdln.MSVCRT ref: 00EF1271
malloc.MSVCRT ref: 00EF12FB
strlen.MSVCRT ref: 00EF132B
malloc.MSVCRT ref: 00EF1336
memcpy.MSVCRT ref: 00EF134C
_amsg_exit.MSVCRT ref: 00EF13F2
_initterm.MSVCRT ref: 00EF1414

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: malloc$ExceptionFilterUnhandled__p__acmdln_amsg_exit_inittermmemcpystrlen
String ID:
API String ID: 2053141405-0
Opcode ID: 5d0939022cef71bfd937a74c3f8e28d03b3f1df2db6a5e581741c46622c0b7f7
Instruction ID: f105b37ef2d6b23d1dc76c775a88be2c0f50051c189b43abe1fa3db7c68a3402
Opcode Fuzzy Hash: 5d0939022cef71bfd937a74c3f8e28d03b3f1df2db6a5e581741c46622c0b7f7
Instruction Fuzzy Hash: 274158B4A0834DCFEB10EFA4E985369BBF0BB44304F10946DE684A7361D774A985EF52

Uniqueness

Uniqueness Score: -1.00%

Function 00EF11B3 Relevance: 10.6, APIs: 7, Instructions: 114
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00EF11C7
SetUnhandledExceptionFilter.KERNEL32 ref: 00EF1248
__p__acmdln.MSVCRT ref: 00EF1271
malloc.MSVCRT ref: 00EF12FB
strlen.MSVCRT ref: 00EF132B
malloc.MSVCRT ref: 00EF1336
memcpy.MSVCRT ref: 00EF134C
_amsg_exit.MSVCRT ref: 00EF13F2
_initterm.MSVCRT ref: 00EF1414

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: malloc$ExceptionFilterSleepUnhandled__p__acmdln_amsg_exit_inittermmemcpystrlen
String ID:
API String ID: 2230096795-0
Opcode ID: 7651ee0390aa782ec823da624cd099fe19ca54fd90863199793a8771b9b08906
Instruction ID: 6924f53c434f7f0c403d14009a8e933fa1addd91db163f57644af3bffa2ce5a1
Opcode Fuzzy Hash: 7651ee0390aa782ec823da624cd099fe19ca54fd90863199793a8771b9b08906
Instruction Fuzzy Hash: 534157B0A0834DCFEB10EFA9D984329BBF0BB44344F10546DE684E7321EB35A985DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EF1170 Relevance: 9.1, APIs: 6, Instructions: 130
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00EF11C7
SetUnhandledExceptionFilter.KERNEL32 ref: 00EF1248
__p__acmdln.MSVCRT ref: 00EF1271
malloc.MSVCRT ref: 00EF12FB
strlen.MSVCRT ref: 00EF132B
malloc.MSVCRT ref: 00EF1336
memcpy.MSVCRT ref: 00EF134C
GetStartupInfoA.KERNEL32 ref: 00EF1443

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled__p__acmdlnmemcpystrlen
String ID:
API String ID: 1672962128-0
Opcode ID: 3ee51dfe335e9c8eb63ed93d3fdfb258e7addf65e0d7f604b0ec1eb095368b69
Instruction ID: d6b002e7f7dd63778077aa18d22cba914d09c725950ccc6aa59a058e581e711d
Opcode Fuzzy Hash: 3ee51dfe335e9c8eb63ed93d3fdfb258e7addf65e0d7f604b0ec1eb095368b69
Instruction Fuzzy Hash: FC5169B0A0434DCFEB10DFA8D984769BBF0BB84304F10956DEA84A7321E735A985DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EF9998 Relevance: 7.5, APIs: 5, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(?,?,00000000,00000001,?,?,00EF83D3), ref: 00EF99AC
FindResourceW.KERNEL32 ref: 00EF99C4
SizeofResource.KERNEL32(?,?,?,?,?,00000000,00000001,?,?,00EF83D3), ref: 00EF99DF
LoadResource.KERNEL32(?,?,?,?,?,?,?,00000000,00000001,?,?,00EF83D3), ref: 00EF99F4
LockResource.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00000001,?,?,00EF83D3), ref: 00EF99FF

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: Resource$FindHandleLoadLockModuleSizeof
String ID:
API String ID: 1601749889-0
Opcode ID: 0c7c3d0f7557435d0e7daf304f8c3f8f5631f876128987b9cc9062e7796d7205
Instruction ID: fb532af16cee849b553a9e0fcb12343f10bb0e64f9f3b7858fbc596274a4c6fe
Opcode Fuzzy Hash: 0c7c3d0f7557435d0e7daf304f8c3f8f5631f876128987b9cc9062e7796d7205
Instruction Fuzzy Hash: B1012CB1908709AFD7506F789D4C67ABBF8FF88751F018A2EF599C3251E77088009B62

Uniqueness

Uniqueness Score: -1.00%

Function 00EFB6A8 Relevance: 44.4, APIs: 24, Strings: 1, Instructions: 694windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32 ref: 00EFB772
FillRect.USER32(?,?), ref: 00EFB78B
GetFocus.USER32 ref: 00EFBBC7
GetClientRect.USER32 ref: 00EFBC26
SetWindowPos.USER32 ref: 00EFBD33
PostQuitMessage.USER32 ref: 00EFBFF6
SetWindowLongW.USER32 ref: 00EFC01B

Strings

N, xrefs: 00EFB751

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: Rect$ClientWindow$FillFocusLongMessagePostQuit
String ID: N
API String ID: 3298376866-1130791706
Opcode ID: 8f178abae375fa311429bc4437a32776a0b9ee24e6c53c54c8e42fa7fa66a136
Instruction ID: 5c34e4ea9ba6a539b4361ea15a92396efa9d0fe7becbb3279945a281e16bce7b
Opcode Fuzzy Hash: 8f178abae375fa311429bc4437a32776a0b9ee24e6c53c54c8e42fa7fa66a136
Instruction Fuzzy Hash: BC522770A0560DCFCB24DF68C988ABEBBF0BF44358F249529E695AB254D734D846CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00EF9144 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 95
memoryprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EF929C: HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00EF87C3,00000000), ref: 00EF93A1
Part of subcall function 00EF929C: HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00EF93BE

Part of subcall function 00EFABB8: strlen.MSVCRT ref: 00EFABD2
Part of subcall function 00EFABB8: HeapAlloc.KERNEL32 ref: 00EFAC34
Part of subcall function 00EFABB8: MultiByteToWideChar.KERNEL32 ref: 00EFAC68
Part of subcall function 00EFABB8: HeapFree.KERNEL32 ref: 00EFAC8B

CreateProcessW.KERNEL32 ref: 00EF9204
CloseHandle.KERNEL32 ref: 00EF921A
HeapFree.KERNEL32 ref: 00EF9241
HeapFree.KERNEL32 ref: 00EF925D
CloseHandle.KERNEL32 ref: 00EF926F
HeapFree.KERNEL32 ref: 00EF928A

Strings

D, xrefs: 00EF91BB
%s %s%Z, xrefs: 00EF9165

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: Heap$Free$CloseHandle$AllocByteCharCreateMultiProcessWidestrlen
String ID: %s %s%Z$D
API String ID: 2791976147-1551950450
Opcode ID: 7429930c6018bc7e21ff7ad3de507e032438bb6f251fe49349c98a46a1f0710b
Instruction ID: 74a971419e747b69d2e6dd25909454e7f7691e8f7e434bc8b6ee2c1d04c81049
Opcode Fuzzy Hash: 7429930c6018bc7e21ff7ad3de507e032438bb6f251fe49349c98a46a1f0710b
Instruction Fuzzy Hash: 28312FB09047099FD700EFB9D88476EBBF5AF84364F118A2DE5A49B3A0D77494498F42

Uniqueness

Uniqueness Score: -1.00%

Function 00EFB104 Relevance: 13.6, APIs: 9, Instructions: 88
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EF9998: GetModuleHandleW.KERNEL32(?,?,00000000,00000001,?,?,00EF83D3), ref: 00EF99AC
Part of subcall function 00EF9998: FindResourceW.KERNEL32 ref: 00EF99C4

GlobalAlloc.KERNEL32 ref: 00EFB132
GlobalLock.KERNEL32 ref: 00EFB148
GlobalFree.KERNEL32 ref: 00EFB15B
GlobalUnlock.KERNEL32 ref: 00EFB177
CreateStreamOnHGlobal.OLE32(00000000), ref: 00EFB193
GlobalFree.KERNEL32 ref: 00EFB1A6

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: Global$Free$AllocCreateFindHandleLockModuleResourceStreamUnlock
String ID:
API String ID: 785323675-0
Opcode ID: 8d8c1c452a514cbd88763eeec3a7f0c068bd93fee47ad75bfcbab044b8057374
Instruction ID: b751262820c0ee0b1eb886cca62f6ada6e7841e96ff123d103b2e59e7543cb9b
Opcode Fuzzy Hash: 8d8c1c452a514cbd88763eeec3a7f0c068bd93fee47ad75bfcbab044b8057374
Instruction Fuzzy Hash: BD31FBB59052089FDB40EFA8C9886AEBBF8FF4C310F058429E948E7210E7759844DF71

Uniqueness

Uniqueness Score: -1.00%

Function 00EFB55C Relevance: 7.5, APIs: 5, Instructions: 43
synchronizationthreadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WaitForSingleObject.KERNEL32 ref: 00EFB579
GetExitCodeThread.KERNEL32 ref: 00EFB58F
CloseHandle.KERNEL32(00000000,00000000), ref: 00EFB59A

Part of subcall function 00EF9144: HeapFree.KERNEL32 ref: 00EF9241
Part of subcall function 00EF9144: HeapFree.KERNEL32 ref: 00EF925D
Part of subcall function 00EF9144: CloseHandle.KERNEL32 ref: 00EF926F
Part of subcall function 00EF9144: HeapFree.KERNEL32 ref: 00EF928A

GetLastError.KERNEL32 ref: 00EFB5BF
SendMessageW.USER32 ref: 00EFB5EE

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: FreeHeap$CloseHandle$CodeErrorExitLastMessageObjectSendSingleThreadWait
String ID:
API String ID: 426020348-0
Opcode ID: 5804254fec41a53d6404086401c4b6caa6f11278a2da26de7c56b8172e134bb1
Instruction ID: 7125a8d993c3680827bc41e0dc4f937c6027dca5f5c0b550c10dd11a13cb5ef7
Opcode Fuzzy Hash: 5804254fec41a53d6404086401c4b6caa6f11278a2da26de7c56b8172e134bb1
Instruction Fuzzy Hash: 571127B44043099FD700AF69DC8CB6EBBE9BB48308F40842CE58597261D7749844DF61

Uniqueness

Uniqueness Score: -1.00%

Function 00EF9BD4 Relevance: 6.1, APIs: 4, Instructions: 94
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EFABB8: strlen.MSVCRT ref: 00EFABD2
Part of subcall function 00EFABB8: HeapAlloc.KERNEL32 ref: 00EFAC34
Part of subcall function 00EFABB8: MultiByteToWideChar.KERNEL32 ref: 00EFAC68
Part of subcall function 00EFABB8: HeapFree.KERNEL32 ref: 00EFAC8B

strlen.MSVCRT ref: 00EF9C26
CreateDirectoryW.KERNEL32 ref: 00EF9CA3
GetLastError.KERNEL32 ref: 00EF9CBC
HeapFree.KERNEL32 ref: 00EF9CEC

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: Heap$Freestrlen$AllocByteCharCreateDirectoryErrorLastMultiWide
String ID:
API String ID: 896362570-0
Opcode ID: 9d182ef87e5b723eb60ebf200ec64a65b17ef9cfe7e7702512a6e32852199c7d
Instruction ID: d9952247ab0df66f91d509e5ffaab8250e37902c7064a0cde25ac77da61b6f16
Opcode Fuzzy Hash: 9d182ef87e5b723eb60ebf200ec64a65b17ef9cfe7e7702512a6e32852199c7d
Instruction Fuzzy Hash: 9931F47150430D8ADB20AB68C8C83BAFBE5EB41358F845169D7D8A7292E3714D85CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EF12A6 Relevance: 5.1, APIs: 4, Instructions: 79
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00EF12FB
strlen.MSVCRT ref: 00EF132B
malloc.MSVCRT ref: 00EF1336
memcpy.MSVCRT ref: 00EF134C

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: 1be87e505fa0f1a7caf4a612f2501c978db446a7e1b1717b5fa2e1a4f04abbd2
Instruction ID: 036b4a3ff0b79a5a1b0e5924b7ef1540890183ec6b76f646569c2c3f46dcac5b
Opcode Fuzzy Hash: 1be87e505fa0f1a7caf4a612f2501c978db446a7e1b1717b5fa2e1a4f04abbd2
Instruction Fuzzy Hash: B93163B4A0434DCFDB10DF69D8803A9BBF1FB48304F10856AEA88A7321E735A945DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00EF13C3 Relevance: 5.1, APIs: 4, Instructions: 65
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00EF12FB
strlen.MSVCRT ref: 00EF132B
malloc.MSVCRT ref: 00EF1336
memcpy.MSVCRT ref: 00EF134C

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: malloc$memcpystrlen
String ID:
API String ID: 3553820921-0
Opcode ID: 9200f3421445b232d6288dbabb4b15012cb2200bbe1e60fede5f877a9e7f0c60
Instruction ID: b037161c97187fbf60709fe2b93ee1fdb5f02421350927927ac5c30dbc07a4ca
Opcode Fuzzy Hash: 9200f3421445b232d6288dbabb4b15012cb2200bbe1e60fede5f877a9e7f0c60
Instruction Fuzzy Hash: B821D8B5E0474DCFDB10DF69D9806A9BBF1FB48300B25852AE688A7311E734A941DF81

Uniqueness

Uniqueness Score: -1.00%

Function 00EFB220 Relevance: 4.6, APIs: 3, Instructions: 50
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GdipCreateHBITMAPFromBitmap.GDIPLUS ref: 00EFB242
GdipGetImageWidth.GDIPLUS ref: 00EFB265
GdipGetImageHeight.GDIPLUS ref: 00EFB28A

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: Gdip$Image$BitmapCreateFromHeightWidth
String ID:
API String ID: 827228198-0
Opcode ID: d5384ace18526dfa02fc9ed9e983848a8f41f5692bbe84d4d7d6a49b42c56bb1
Instruction ID: 42174c4edbe86bb381219e42f6be4f12dc4fe6c3c095cb9a2746abb330ea8b36
Opcode Fuzzy Hash: d5384ace18526dfa02fc9ed9e983848a8f41f5692bbe84d4d7d6a49b42c56bb1
Instruction Fuzzy Hash: 6B11C8B0D0420A9FDB10DFA9C48466EFBF8EB84344F04C46AE958EB205E374D8058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EF9DB8 Relevance: 3.1, APIs: 2, Instructions: 88
filememoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EFABB8: strlen.MSVCRT ref: 00EFABD2
Part of subcall function 00EFABB8: HeapAlloc.KERNEL32 ref: 00EFAC34
Part of subcall function 00EFABB8: MultiByteToWideChar.KERNEL32 ref: 00EFAC68
Part of subcall function 00EFABB8: HeapFree.KERNEL32 ref: 00EFAC8B

CreateFileW.KERNEL32 ref: 00EF9EB6
HeapFree.KERNEL32 ref: 00EF9EE5

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: Heap$Free$AllocByteCharCreateFileMultiWidestrlen
String ID:
API String ID: 4054799010-0
Opcode ID: 373272a8f7966067a0b23ed68b5d31c3f669f4db83ee837deffaa73a37a9fc86
Instruction ID: a47963fae0fbcc443f6e6aa6aec43466c56bece0e042ad5fe0b6eb40606ed609
Opcode Fuzzy Hash: 373272a8f7966067a0b23ed68b5d31c3f669f4db83ee837deffaa73a37a9fc86
Instruction Fuzzy Hash: B231F771E042088BDB10DF69DC883AEBBF1EBD4314F2496A9E598E7285D7748E44CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00EF9A14 Relevance: 3.1, APIs: 2, Instructions: 58COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00EFD008,?,?,00EFB07B), ref: 00EF9A31
CreateWindowExW.USER32 ref: 00EF9AAF

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: CreateHandleModuleWindow
String ID:
API String ID: 1178124398-0
Opcode ID: cb0ae706af26eaafef5c0f4436c26013d896decbb43b7ed9f35eaa45af35477c
Instruction ID: bcb37b534d768e9658a1b1bd5861aa7c4636698ca70bb0e95a5f0dfd50f6e71a
Opcode Fuzzy Hash: cb0ae706af26eaafef5c0f4436c26013d896decbb43b7ed9f35eaa45af35477c
Instruction Fuzzy Hash: 181125B1A193159FC704CF69D98561AFBE9FB8C324F108A6EF898D7350D370E9108B96

Uniqueness

Uniqueness Score: -1.00%

Function 00EFAEFC Relevance: 3.0, APIs: 2, Instructions: 40memorywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFABB8: strlen.MSVCRT ref: 00EFABD2
Part of subcall function 00EFABB8: HeapAlloc.KERNEL32 ref: 00EFAC34
Part of subcall function 00EFABB8: MultiByteToWideChar.KERNEL32 ref: 00EFAC68
Part of subcall function 00EFABB8: HeapFree.KERNEL32 ref: 00EFAC8B

SendMessageW.USER32 ref: 00EFAF57
HeapFree.KERNEL32 ref: 00EFAF78

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: Heap$Free$AllocByteCharMessageMultiSendWidestrlen
String ID:
API String ID: 2843101947-0
Opcode ID: 91992ab8e5c805259988dd032d6184d7a877c18544dcafc97d3a1fc2e8e70142
Instruction ID: 4293f80aa611ee01b1156df069f3be99e11c0e75793edbceb1077afc84f09326
Opcode Fuzzy Hash: 91992ab8e5c805259988dd032d6184d7a877c18544dcafc97d3a1fc2e8e70142
Instruction Fuzzy Hash: 74015EB5A043089BD710AF69E8887ADBBF5FF84300F14856DE9489B350D7715948CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00EF9F00 Relevance: 3.0, APIs: 2, Instructions: 31filememoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFABB8: strlen.MSVCRT ref: 00EFABD2
Part of subcall function 00EFABB8: HeapAlloc.KERNEL32 ref: 00EFAC34
Part of subcall function 00EFABB8: MultiByteToWideChar.KERNEL32 ref: 00EFAC68
Part of subcall function 00EFABB8: HeapFree.KERNEL32 ref: 00EFAC8B

DeleteFileW.KERNEL32 ref: 00EF9F3A
HeapFree.KERNEL32 ref: 00EF9F59

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: Heap$Free$AllocByteCharDeleteFileMultiWidestrlen
String ID:
API String ID: 3068648626-0
Opcode ID: cb4bed8a08d1a97755acd36883aa8601982111f9ea6eb9ea1c17086ac8ff74d9
Instruction ID: 28426852fa039b72351ee9dc5043211be26c06700d51e2b08c9310ef28c42df8
Opcode Fuzzy Hash: cb4bed8a08d1a97755acd36883aa8601982111f9ea6eb9ea1c17086ac8ff74d9
Instruction Fuzzy Hash: FAF030B16043189BCB10AFA9EC8C6AABBB8FB04724F008659E5D8D7291D77059888F91

Uniqueness

Uniqueness Score: -1.00%

Function 00EFADDC Relevance: 3.0, APIs: 2, Instructions: 29COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,00EF8668), ref: 00EFAE00
LoadImageW.USER32 ref: 00EFAE2A

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: HandleImageLoadModule
String ID:
API String ID: 2603579926-0
Opcode ID: de2b7d5ac85c8f950cfec6413c975eaef8b8cb3c0ee9350f3218096c65b5daa5
Instruction ID: 5fe9aecd2ee1bda6749a19feae6f3f7f9f6cf77327c23d13b3192995b979b961
Opcode Fuzzy Hash: de2b7d5ac85c8f950cfec6413c975eaef8b8cb3c0ee9350f3218096c65b5daa5
Instruction Fuzzy Hash: CDF012B19083049FD700AF69E94D39AFFF5FB88354F40892EE9D883350D7B555548B92

Uniqueness

Uniqueness Score: -1.00%

Function 00EF98B4 Relevance: 1.6, APIs: 1, Instructions: 65windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32 ref: 00EF992A

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 72fce77b03041501b7467f1ed2756c7193d6b32fcca6bdfebaced2485e72c975
Instruction ID: dc916b2c6a387ccacfeef65c2107a06dadf96c4ec535355e489cf29207e2817a
Opcode Fuzzy Hash: 72fce77b03041501b7467f1ed2756c7193d6b32fcca6bdfebaced2485e72c975
Instruction Fuzzy Hash: 54217471A043049FDB04DF59D4847AEBBF4FBC8368F10962ED698AB291C3759805CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00EFB020 Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

CreateSolidBrush.GDI32 ref: 00EFB04F

Part of subcall function 00EF9A14: GetModuleHandleW.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,00EFD008,?,?,00EFB07B), ref: 00EF9A31
Part of subcall function 00EF9A14: CreateWindowExW.USER32 ref: 00EF9AAF

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: Create$BrushHandleModuleSolidWindow
String ID:
API String ID: 1662306801-0
Opcode ID: 5864439495853052e0b7714f51a1e45abe4fc038b9f9699d7d94a77cf8568223
Instruction ID: 74c6f7b387891ef6c77c487a14c6fbe9912b0659c676ba01f478e85e707a0492
Opcode Fuzzy Hash: 5864439495853052e0b7714f51a1e45abe4fc038b9f9699d7d94a77cf8568223
Instruction Fuzzy Hash: ABF0BBB15003089BDB00DF66D8447DABFF5FFC4310F014028EA44A7292D7759484CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00EF8C90 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL ref: 00EF8CB6

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 1e008f1076ca6d3d1b28099cea8b13200b20e33af187b1932ce8d3c6e9e3c40d
Instruction ID: 4178e28604cf2b425255fc6c1be8f6c84a363407ec50afc5187aa0e9b196fc53
Opcode Fuzzy Hash: 1e008f1076ca6d3d1b28099cea8b13200b20e33af187b1932ce8d3c6e9e3c40d
Instruction Fuzzy Hash: 61E0E5B0504304DFDB00EF28D689B06BFF4AB44308F0484A8D8489B3A6D7B5D848CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00EF9B84 Relevance: 1.3, APIs: 1, Instructions: 36stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00EF9B91

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: strlen
String ID:
API String ID: 39653677-0
Opcode ID: 1b6b4a49818362832c93dce2a13d75510bb9af8dc27697fe666a996c876aae41
Instruction ID: 46a139f4401563f90e75c0bb4f4a638dd96438dda6c2f0633a14d1608d4e6cb9
Opcode Fuzzy Hash: 1b6b4a49818362832c93dce2a13d75510bb9af8dc27697fe666a996c876aae41
Instruction Fuzzy Hash: 41F0A71162C2EC5BCF2536B824C13BABBD84B1E204B0429E5D6D5EB347E0918858439A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00EF93D8 Relevance: 40.5, APIs: 19, Strings: 4, Instructions: 268windowstringCOMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32 ref: 00EF941D

Part of subcall function 00EFB020: CreateSolidBrush.GDI32 ref: 00EFB04F

GetWindowLongW.USER32 ref: 00EF945E
SetWindowLongW.USER32 ref: 00EF9482

Part of subcall function 00EFAEFC: SendMessageW.USER32 ref: 00EFAF57
Part of subcall function 00EFAEFC: HeapFree.KERNEL32 ref: 00EFAF78

Part of subcall function 00EFAE88: SetWindowPos.USER32 ref: 00EFAEEB

ShowWindow.USER32 ref: 00EF9514

Part of subcall function 00EFADDC: GetModuleHandleW.KERNEL32(?,?,?,00EF8668), ref: 00EFAE00
Part of subcall function 00EFADDC: LoadImageW.USER32 ref: 00EFAE2A

SendMessageW.USER32(00000000,00000000), ref: 00EF955D
SendMessageW.USER32 ref: 00EF9588

Part of subcall function 00EFAD58: MultiByteToWideChar.KERNEL32 ref: 00EFADA4

CreateFontIndirectW.GDI32 ref: 00EF95AA
CreateSolidBrush.GDI32(?), ref: 00EF95C5
LoadImageW.USER32 ref: 00EF9671
SendMessageW.USER32 ref: 00EF969C
ShowWindow.USER32 ref: 00EF96C1
strlen.MSVCRT ref: 00EF96DA
ShowWindow.USER32(00000000,00000000), ref: 00EF9732
LoadCursorW.USER32(00000000,00000000), ref: 00EF9757
SetWindowLongW.USER32 ref: 00EF978D
CreateFontIndirectW.GDI32 ref: 00EF9816
SendMessageW.USER32 ref: 00EF984B
strlen.MSVCRT ref: 00EF9874
ShowWindow.USER32 ref: 00EF98A6

Strings

Download AdGuard VPN, xrefs: 00EF9851
An error has occurred during the installation.Please try downloading the installer manually., xrefs: 00EF93E4
AdGuard VPN Web Installer, xrefs: 00EF9499
0, xrefs: 00EF9836

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: Window$MessageSend$CreateShow$LoadLong$BrushFontImageIndirectSolidstrlen$ByteCharCursorFreeHandleHeapInfoLocaleModuleMultiWide
String ID: 0$AdGuard VPN Web Installer$An error has occurred during the installation.Please try downloading the installer manually.$Download AdGuard VPN
API String ID: 3353892530-2983585088
Opcode ID: 7e5bbdf9597c357011b6a544b8bf17661d86d4f821cf171eabe1a659b06f97a3
Instruction ID: 17e97b232029a573dce9b902ab142419cdf8c6945df4f5e8c6b24cecc68f05da
Opcode Fuzzy Hash: 7e5bbdf9597c357011b6a544b8bf17661d86d4f821cf171eabe1a659b06f97a3
Instruction Fuzzy Hash: 1AD14DB45043198FD710EF29C8487AABBF1FF84314F00896DE598AB361D774A988DF92

Uniqueness

Uniqueness Score: -1.00%

Function 00EF14F0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32 ref: 00EF1500
LoadLibraryA.KERNEL32 ref: 00EF1516
GetProcAddress.KERNEL32 ref: 00EF1535
GetProcAddress.KERNEL32 ref: 00EF1547

Strings

__deregister_frame_info, xrefs: 00EF153C
__register_frame_info, xrefs: 00EF152A
libgcc_s_dw2-1.dll, xrefs: 00EF14F9, 00EF150F

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: __deregister_frame_info$__register_frame_info$libgcc_s_dw2-1.dll
API String ID: 384173800-1835852900
Opcode ID: 4c4d3db366e81fe2a5fda6e6a99e7932293a43f9ab6c1e74de3787bd6285465d
Instruction ID: 562501ee77535dd6dc63f0ee869f988d9b327c130a83b0e04d450d82aa5b33c0
Opcode Fuzzy Hash: 4c4d3db366e81fe2a5fda6e6a99e7932293a43f9ab6c1e74de3787bd6285465d
Instruction Fuzzy Hash: B5015EB180920CDFC700BF79A94923ABFE5EBC0354F01546DD68967211DBB59448DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00EF5010 Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 1481COMMON

Download Yara Rule

Strings

Infinity, xrefs: 00EF5340
, xrefs: 00EF6786
NaN, xrefs: 00EF50DF
9, xrefs: 00EF65AB
, xrefs: 00EF64EE

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID:
String ID: $ $9$Infinity$NaN
API String ID: 0-2156819404
Opcode ID: c13e76f9154857ecfea2a6d3a323806247ed5ab47f1c664e01216d8acec9d380
Instruction ID: 1797f07bdb2c0993066c2e2ada30a57f9c8b8250b19006659e36e7a1d4beede1
Opcode Fuzzy Hash: c13e76f9154857ecfea2a6d3a323806247ed5ab47f1c664e01216d8acec9d380
Instruction Fuzzy Hash: 59D254B2A087858FD710DF29C08076AFBE1BF94344F14991DEA99A7361E771D844CF82

Uniqueness

Uniqueness Score: -1.00%

Function 00EF3D60 Relevance: 7.9, Strings: 6, Instructions: 417COMMON

Download Yara Rule

Strings

Inf, xrefs: 00EF42AC
NaN, xrefs: 00EF40C2
gfff, xrefs: 00EF3E35
@, xrefs: 00EF3ECC
., xrefs: 00EF3DFD
gfff, xrefs: 00EF3E70

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID:
String ID: .$@$Inf$NaN$gfff$gfff
API String ID: 0-3155045678
Opcode ID: c02e2509ef0105cf76cb7aa2692a55401fe0679814db2bdd76386511074ebe66
Instruction ID: e785778bdd8ead95af4b93d40de86aa7168b22cb27200a3c047bc78b0943e087
Opcode Fuzzy Hash: c02e2509ef0105cf76cb7aa2692a55401fe0679814db2bdd76386511074ebe66
Instruction Fuzzy Hash: 50E1D6B1A083098BD7149E39C48427BB7E1AFC4308F149A2DFA99EB395D731DD45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EF18C0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 129fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00EF18EF
vfprintf.MSVCRT ref: 00EF190F
abort.MSVCRT ref: 00EF1914
VirtualQuery.KERNEL32 ref: 00EF19AB

Strings

Address %p has no image-section, xrefs: 00EF1A6B
Mingw-w64 runtime failure:, xrefs: 00EF18E8
VirtualProtect failed with code 0x%x, xrefs: 00EF1A26
VirtualQuery failed for %d bytes at address %p, xrefs: 00EF1A57

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: QueryVirtualabortfwritevfprintf
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 2513968241-1534286854
Opcode ID: f9832b48526df59c887fe723f7baf4aeb0da0501024a95ba06a112be5986c1d9
Instruction ID: 3fcd6a1b508985fb893e3ee3b3dc25c2c7cd4c8cb309b2ec5374d416fac5071c
Opcode Fuzzy Hash: f9832b48526df59c887fe723f7baf4aeb0da0501024a95ba06a112be5986c1d9
Instruction Fuzzy Hash: 7D516CB1904309CFC710EF28D98566AFBE0FF84354F45C95DE6C8AB221E735E8488B92

Uniqueness

Uniqueness Score: -1.00%

Function 00EFB2AC Relevance: 16.7, APIs: 11, Instructions: 196COMMON

Download Yara Rule

APIs

GetDC.USER32 ref: 00EFB2C4
CreateCompatibleDC.GDI32 ref: 00EFB2D1
SelectObject.GDI32 ref: 00EFB2F0
GdipCreateFromHDC.GDIPLUS ref: 00EFB351
GdipCreateSolidFill.GDIPLUS ref: 00EFB385
GdipFillRectangleI.GDIPLUS ref: 00EFB3BB
GdipDeleteGraphics.GDIPLUS(?,?,?,00EFB642), ref: 00EFB3DA
CreateCompatibleDC.GDI32(00000000), ref: 00EFB3E6
AlphaBlend.MSIMG32 ref: 00EFB460
UpdateLayeredWindow.USER32 ref: 00EFB514
ReleaseDC.USER32(00000000), ref: 00EFB54B

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: CreateGdip$CompatibleFill$AlphaBlendDeleteFromGraphicsLayeredObjectRectangleReleaseSelectSolidUpdateWindow
String ID:
API String ID: 545367414-0
Opcode ID: 031573b319fc84504867ba24f75895e3da2532c0b231c751c06c51fa09bc1f67
Instruction ID: de8ac1f72cb1322f5bc3fb65d572064ffed11fc87b7e5eb697ce3e251abe5296
Opcode Fuzzy Hash: 031573b319fc84504867ba24f75895e3da2532c0b231c751c06c51fa09bc1f67
Instruction Fuzzy Hash: E8918FB49053199FCB40DFA9D984A9EBBF5FB88314F00892EE898E7310E7749944CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00EF1D50 Relevance: 12.1, APIs: 8, Instructions: 90COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00EF1D8F
signal.MSVCRT ref: 00EF1DD6
signal.MSVCRT ref: 00EF1DEF
signal.MSVCRT ref: 00EF1E16
signal.MSVCRT ref: 00EF1E5A

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: signal
String ID:
API String ID: 1946981877-0
Opcode ID: ebb2c3a7dfd6b6026d26bae704846db37c2902a0b8afeaa8a75537769b944e7a
Instruction ID: e575a3ad6f3826fd376f7c72575f2ad2c1481d619abc8cf18df9a82b4f179419
Opcode Fuzzy Hash: ebb2c3a7dfd6b6026d26bae704846db37c2902a0b8afeaa8a75537769b944e7a
Instruction Fuzzy Hash: AD312FB051820DCAE7606F688940339B6E0AB4137DF116A4DEAE4E72D1CB7A8984DB53

Uniqueness

Uniqueness Score: -1.00%

Function 00EF2AB0 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 395COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00EF2C60
memset.MSVCRT ref: 00EF2D7F

Strings

0, xrefs: 00EF2FA7
o, xrefs: 00EF2FC8

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: fputcmemset
String ID: 0$o
API String ID: 947785774-4157579757
Opcode ID: 8e0685638adb49ae4f37e01c505298bd78bdcd604d7e6113846537aeeb44b7b6
Instruction ID: 9f8785415631b0364dcbf2bc9c1fd0fc0b3c9c1b2be2e33ab2e809f6bbb5fe10
Opcode Fuzzy Hash: 8e0685638adb49ae4f37e01c505298bd78bdcd604d7e6113846537aeeb44b7b6
Instruction Fuzzy Hash: C2F14D72E102188BDB15DF68C4902ADBBF1AF84314F29926DEA55FB385D735E842CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EF7E61 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00EF7E6C
GetProcAddress.KERNEL32 ref: 00EF7E8C
GetProcAddress.KERNEL32 ref: 00EF7ECB

Strings

___lc_codepage_func, xrefs: 00EF7E84
__lc_codepage, xrefs: 00EF7EC0
msvcrt.dll, xrefs: 00EF7E65

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: ___lc_codepage_func$__lc_codepage$msvcrt.dll
API String ID: 667068680-1145701848
Opcode ID: a3e227504e4e75f92acfe55d662b4272404d10d9646aff56678f73390d1dd75c
Instruction ID: 143211d1e1db47741fe9f5e1fe3d0864a22b85ff2aa3c66da85d66f0ad5059c9
Opcode Fuzzy Hash: a3e227504e4e75f92acfe55d662b4272404d10d9646aff56678f73390d1dd75c
Instruction Fuzzy Hash: B5F062B19092088FD700BF386D4913A7AE1B644314F45197ECAC5E7250E770D854D7A2

Uniqueness

Uniqueness Score: -1.00%

Function 00EF3050 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 287COMMON

Download Yara Rule

Strings

0, xrefs: 00EF33FA

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 906d0336041f0955854ea0fe103f6f14ae2e15edb6cc9c825826e81eb6b08927
Instruction ID: 4fccc3c300dd6043932353ec7acd535c36f034421dd28292a71e34fa337ae358
Opcode Fuzzy Hash: 906d0336041f0955854ea0fe103f6f14ae2e15edb6cc9c825826e81eb6b08927
Instruction Fuzzy Hash: B0B16C71A052198BDB14CF78C4847AABBF1AF88304F199169EE59BF356D734EE01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EF3183 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 96COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00EF31BD
fputc.MSVCRT ref: 00EF3277
fputc.MSVCRT ref: 00EF32D1

Strings

0, xrefs: 00EF31AE

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: fputc$memset
String ID: 0
API String ID: 2944404495-4108050209
Opcode ID: 0ae888e68ee06ac94637e7e2c572a203338626a9d5973659b47df7a582a49451
Instruction ID: c939912ae3e94c7eaf9f6e95b2ddaf80d705dd10c9c12547d792fd044ce1ca6d
Opcode Fuzzy Hash: 0ae888e68ee06ac94637e7e2c572a203338626a9d5973659b47df7a582a49451
Instruction Fuzzy Hash: 9C313C71E052198BEB14CF78C18476ABBE2BF44744F159569EE48BB355D730EE01CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00EF33CB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

fputc.MSVCRT ref: 00EF3277
fputc.MSVCRT ref: 00EF32D1
memset.MSVCRT ref: 00EF3405

Strings

0, xrefs: 00EF33FA

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: fputc$memset
String ID: 0
API String ID: 2944404495-4108050209
Opcode ID: cf32a4d500d49d76f558de93517f77d76bc5c35e592a36b3ebc26798908fe853
Instruction ID: 04a7662a77ce53adcc438d84334dba40ed9af41453e199e0b55a1ab67171d865
Opcode Fuzzy Hash: cf32a4d500d49d76f558de93517f77d76bc5c35e592a36b3ebc26798908fe853
Instruction Fuzzy Hash: 73213EB1904209CBEB14DF78C084365B7E2BF84304F25A659DA99AF366D734EE41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00EF7E18 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 19stringCOMMON

Download Yara Rule

APIs

setlocale.MSVCRT ref: 00EF7E32
strchr.MSVCRT ref: 00EF7E42
atoi.MSVCRT ref: 00EF7E53

Strings

., xrefs: 00EF7E37

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: atoisetlocalestrchr
String ID: .
API String ID: 1223908000-248832578
Opcode ID: 2e20cc0a2f8bd01d80a18571f6e875e0734c2b59010ac96151a74daf2c5f9a7c
Instruction ID: 871c8229c1037eb5a1f8ab21ecae6a593629f1813f7b1ee21f5bcfd38fe42f37
Opcode Fuzzy Hash: 2e20cc0a2f8bd01d80a18571f6e875e0734c2b59010ac96151a74daf2c5f9a7c
Instruction Fuzzy Hash: 6CE0ECB1A087044AD7007F38C50A36ABAE1AF80304F4998ADE5C8A7746E77998459752

Uniqueness

Uniqueness Score: -1.00%

Function 00EFABB8 Relevance: 6.3, APIs: 5, Instructions: 73memorystringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00EFABD2
MultiByteToWideChar.KERNEL32 ref: 00EFAC02
HeapAlloc.KERNEL32 ref: 00EFAC34
MultiByteToWideChar.KERNEL32 ref: 00EFAC68
HeapFree.KERNEL32 ref: 00EFAC8B

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: ByteCharHeapMultiWide$AllocFreestrlen
String ID:
API String ID: 998811608-0
Opcode ID: bf9459bf085fbf241bc7c3a68379e773705e09c0d5baf3bf5a517925a3991262
Instruction ID: 39683e4a753a63cb661781109bf5ed4492c3785d4cbdfe47bc19c5e147d1e5c1
Opcode Fuzzy Hash: bf9459bf085fbf241bc7c3a68379e773705e09c0d5baf3bf5a517925a3991262
Instruction Fuzzy Hash: F1310CB09083099FD710EF69D58866AFFF4FF88314F05892EE988DB250E77498459B93

Uniqueness

Uniqueness Score: -1.00%

Function 00EF7820 Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 00EF7872
MultiByteToWideChar.KERNEL32 ref: 00EF78B5

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: 712a1cc6119baf220a9a51bc183963394ad1e645eacfa1349cb1630058f4e824
Instruction ID: 97fbcbb166d402600db04236dd5f971c97d0b0732e7b4cf33781eeb26ca6264e
Opcode Fuzzy Hash: 712a1cc6119baf220a9a51bc183963394ad1e645eacfa1349cb1630058f4e824
Instruction Fuzzy Hash: CE4114B050D3458FD710DF28D48826ABBE0BF85318F05992EE9D49B390E3B6D849CB93

Uniqueness

Uniqueness Score: -1.00%

Function 00EF1001 Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00EF1075
__p__fmode.MSVCRT ref: 00EF107A
__p__commode.MSVCRT ref: 00EF1087

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: __p__commode__p__fmode__set_app_type
String ID:
API String ID: 3338496922-0
Opcode ID: 51d0c7eab9e3de355aa0aa68cced151d8f9cce978eb9c511abd1fe2665680225
Instruction ID: 8f249760ae3de1eee2fe6f121c212a4fe4e3f9b1fbb15f0872b987c3635e8782
Opcode Fuzzy Hash: 51d0c7eab9e3de355aa0aa68cced151d8f9cce978eb9c511abd1fe2665680225
Instruction Fuzzy Hash: 7821B77050438DCFC714AF20C8153B637E1FB40388F5495A9C6846B25ADF7B98CAEBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EF1A80 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 187COMMON

Download Yara Rule

Strings

Unknown pseudo relocation bit size %d., xrefs: 00EF1B84
Unknown pseudo relocation protocol version %d., xrefs: 00EF1CD3

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID:
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 0-395989641
Opcode ID: 6f6a72e3df036544b9fb312e1ce1a5421129e807954504ec49c42bf2c855a036
Instruction ID: 6b415544390d9f957ce81d928369a5515544d493ecb69ea62a8364aefb966ff5
Opcode Fuzzy Hash: 6f6a72e3df036544b9fb312e1ce1a5421129e807954504ec49c42bf2c855a036
Instruction Fuzzy Hash: BE71C235A0420DCBCB14DF28D8801BAB7F2FFC4384F159A9AEA95B7315E731A9458B91

Uniqueness

Uniqueness Score: -1.00%

Function 00EFAF8C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00EFABB8: strlen.MSVCRT ref: 00EFABD2
Part of subcall function 00EFABB8: HeapAlloc.KERNEL32 ref: 00EFAC34
Part of subcall function 00EFABB8: MultiByteToWideChar.KERNEL32 ref: 00EFAC68
Part of subcall function 00EFABB8: HeapFree.KERNEL32 ref: 00EFAC8B

ShellExecuteW.SHELL32 ref: 00EFAFEE
HeapFree.KERNEL32 ref: 00EFB00F

Strings

open, xrefs: 00EFAFDF

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: Heap$Free$AllocByteCharExecuteMultiShellWidestrlen
String ID: open
API String ID: 2746946616-2758837156
Opcode ID: de1c4ac4951bf1a27cfed9869aeb3679c39766af22671e43adea5ad63b631ac8
Instruction ID: 70bb40c1b04eb8dab5559c877a6e00b1240a8e8f3cf05f94bb1f35960c6a2b2e
Opcode Fuzzy Hash: de1c4ac4951bf1a27cfed9869aeb3679c39766af22671e43adea5ad63b631ac8
Instruction Fuzzy Hash: DA014BB0509309DFD750AFA8D84879EBFF4EB44314F008A5CE5A8A7290D7B59988CFD2

Uniqueness

Uniqueness Score: -1.00%

Function 00EF1830 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00EF189E

Strings

Unknown error, xrefs: 00EF1832
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00EF187F

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: a592e3ac641477570512e71ed6d968ca4cf73caf290bf83f7218227296243c64
Instruction ID: 5bd0a5515c989d395ebb043b58a73efb7b33155f84272e9ad98c35d9d5261cdd
Opcode Fuzzy Hash: a592e3ac641477570512e71ed6d968ca4cf73caf290bf83f7218227296243c64
Instruction Fuzzy Hash: E40196B0408B49CBD300AF15E58942AFFF1FF89354F86989CF5D456269DB329868C746

Uniqueness

Uniqueness Score: -1.00%

Function 00EFAE3C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00EF9AC0: SetWindowLongW.USER32 ref: 00EF9B24

SendMessageW.USER32 ref: 00EFAE78

Strings

0, xrefs: 00EFAE6D
An error has occurred during the installation.Please try downloading the installer manually., xrefs: 00EFAE42

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: LongMessageSendWindow
String ID: 0$An error has occurred during the installation.Please try downloading the installer manually.
API String ID: 3360111000-109714329
Opcode ID: 90a9e3f1a9567ec3de6677aa659e070888c2b814ede745f5a9df87a614afd87b
Instruction ID: 0b5e2a8d3f5dab97acc69f4c0d485b35115736eb05e789aaf2bfb49a50b50ce3
Opcode Fuzzy Hash: 90a9e3f1a9567ec3de6677aa659e070888c2b814ede745f5a9df87a614afd87b
Instruction Fuzzy Hash: CFF039B0A042149FEB00AF79C88976ABBE8EF44354F408469EA589B241E730D854CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EF6940 Relevance: 5.1, APIs: 4, Instructions: 55sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,?,00EF6A71,?,?,?,?,?,?,00000000,00EF4D84), ref: 00EF6967
InitializeCriticalSection.KERNEL32(?,?,?,?,00EF6A71,?,?,?,?,?,?,00000000,00EF4D84), ref: 00EF69A4
InitializeCriticalSection.KERNEL32(?,?,?,?,?,00EF6A71,?,?,?,?,?,?,00000000,00EF4D84), ref: 00EF69B0
EnterCriticalSection.KERNEL32(?,?,?,?,00EF6A71,?,?,?,?,?,?,00000000,00EF4D84), ref: 00EF69D8

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: CriticalSection$Initialize$EnterSleep
String ID:
API String ID: 1117354567-0
Opcode ID: b5ca092031eecad21900d7471ed0d9825914ecd393482eac388632bf78a271f4
Instruction ID: 43a5285c62a4119114564cdc0380960159d90b97184ac3dce1a987fc4a6344cc
Opcode Fuzzy Hash: b5ca092031eecad21900d7471ed0d9825914ecd393482eac388632bf78a271f4
Instruction Fuzzy Hash: 2611E1B090120D8BDB11AB2CEDC927A37E0FB40304F150425D582E7225E7B9DCC8EB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EF1F00 Relevance: 5.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00EF20CB,?,?,?,?,?,00EF1768), ref: 00EF1F0E
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00EF20CB,?,?,?,?,?,00EF1768), ref: 00EF1F35
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00EF20CB,?,?,?,?,?,00EF1768), ref: 00EF1F3C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,00EF20CB,?,?,?,?,?,00EF1768), ref: 00EF1F5C

Memory Dump Source

Source File: 00000000.00000002.1682826161.0000000000EF1000.00000020.00000001.01000000.00000003.sdmp, Offset: 00EF0000, based on PE: true

Associated: 00000000.00000002.1682808383.0000000000EF0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682846929.0000000000EFD000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682865073.0000000000EFE000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682884016.0000000000F02000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F03000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682907274.0000000000F06000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1682942937.0000000000F0F000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_ef0000_TsU2RShnl7.jbxd

Similarity

API ID: CriticalSection$EnterErrorLastLeaveValue
String ID:
API String ID: 682475483-0
Opcode ID: 6aff14048ef902ade03990903a5a18ee552f6dc38d1d704ca9df5e0a8dc17477
Instruction ID: 57ee2fed8a8bb53323d85af7b0ce662059a2708c47e8ece966d3641be9b403f4
Opcode Fuzzy Hash: 6aff14048ef902ade03990903a5a18ee552f6dc38d1d704ca9df5e0a8dc17477
Instruction Fuzzy Hash: FEF0CD7670021CCFCB107F74DD8852A7BA4FE04344F050169DD8957315D730A845DBA2

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: setup.exePID: 7204, Parent PID: 5004COMMON

Executed Functions

Function 00BD51D2 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 00BD5254

Part of subcall function 00C0FDC4: InitializeCriticalSection.KERNEL32(00C3B5D4,?,00BD5260,00000000,?,?,?,?,?,?), ref: 00C0FDDB

Part of subcall function 00BD1206: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,00BD527C,00000000,?), ref: 00BD1244
Part of subcall function 00BD1206: GetLastError.KERNEL32(?,?,?,00BD527C,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00BD124E

CoInitializeEx.OLE32(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00BD52C2

Part of subcall function 00C106C0: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00C106E1

GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 00BD5354
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00BD535E
CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00BD55CB

Strings

Failed to initialize Regutil., xrefs: 00BD5306
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 00BD5382
Failed to get OS info., xrefs: 00BD538C
Failed to initialize Wiutil., xrefs: 00BD531E
Failed to initialize Cryputil., xrefs: 00BD52E3
Failed to run untrusted mode., xrefs: 00BD54F3
Invalid run mode., xrefs: 00BD5436
Failed to run embedded mode., xrefs: 00BD5481
Failed to parse command line., xrefs: 00BD5282
Failed to initialize engine state., xrefs: 00BD52A9
Failed to initialize core., xrefs: 00BD5400
Failed to initialize COM., xrefs: 00BD52CE
Failed to initialize XML util., xrefs: 00BD5336
Failed to run RunOnce mode., xrefs: 00BD5459
3.11.2.4516, xrefs: 00BD53C1
@, xrefs: 00BD5532
Failed to run per-machine mode., xrefs: 00BD54A9
Failed to run per-user mode., xrefs: 00BD54D1

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
String ID: 3.11.2.4516$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$c:\agent\_work\66\s\src\burn\engine\engine.cpp$@
API String ID: 3262001429-4222581132
Opcode ID: 33f8653cf2319e6cf5036398580b54f135f6752f103cc55916a6678ffae98910
Instruction ID: 0cd0b2d0865609b9c2dcdd99e90e36e2e2f59d6b747bf474aa50ae4bb3703f16
Opcode Fuzzy Hash: 33f8653cf2319e6cf5036398580b54f135f6752f103cc55916a6678ffae98910
Instruction Fuzzy Hash: FDB1AF71D41A299BDB32AF649D85BEDB6E8AF05710F0401E6E908B6341FB309EC4DE91

Uniqueness

Uniqueness Score: -1.00%

Function 00C128BD Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 152
libraryloadercomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00C12E6B,00000000,?,00000000), ref: 00C128D7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00BFBD14,?,00BD5442,?,00000000,?), ref: 00C128E3
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00C12923
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00C1292F
GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 00C1293A
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00C12944
CoCreateInstance.OLE32(00C3B688,00000000,00000001,00C1A878,?,?,?,?,?,?,?,?,?,?,?,00BFBD14), ref: 00C1297F
ExitProcess.KERNEL32 ref: 00C12A2E

Strings

Wow64RevertWow64FsRedirection, xrefs: 00C1293C
IsWow64Process, xrefs: 00C1291D
kernel32.dll, xrefs: 00C128C7
Wow64EnableWow64FsRedirection, xrefs: 00C12931
c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 00C12907
Wow64DisableWow64FsRedirection, xrefs: 00C12929

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp$kernel32.dll
API String ID: 2124981135-3734847636
Opcode ID: e9ccbe1f4151ef4f032bd51ab83c002ae7aeaf8f0d4f477872c00b5757943994
Instruction ID: 8d5eed0df6a57981f9ed5e6c063efff9e0f153c9ac8e38f83e975429d4eb9412
Opcode Fuzzy Hash: e9ccbe1f4151ef4f032bd51ab83c002ae7aeaf8f0d4f477872c00b5757943994
Instruction Fuzzy Hash: 7341E13AA01315AFDB25DBA8C845FEEB7B4EF06710F114068F901EB241D775DE91AB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BD1070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 77fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD34C4: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,00BD10DD,?,00000000), ref: 00BD34E5

CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 00BD10F6

Part of subcall function 00BD1173: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,00BD111A,cabinet.dll,00000009,?,?,00000000), ref: 00BD1184
Part of subcall function 00BD1173: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,00BD111A,cabinet.dll,00000009,?,?,00000000), ref: 00BD118F
Part of subcall function 00BD1173: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00BD119D
Part of subcall function 00BD1173: GetLastError.KERNEL32(?,?,?,?,?,00BD111A,cabinet.dll,00000009,?,?,00000000), ref: 00BD11B8
Part of subcall function 00BD1173: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00BD11C0
Part of subcall function 00BD1173: GetLastError.KERNEL32(?,?,?,?,?,00BD111A,cabinet.dll,00000009,?,?,00000000), ref: 00BD11D5

CloseHandle.KERNEL32(?,?,?,?,00C1A4D0,?,cabinet.dll,00000009,?,?,00000000), ref: 00BD1131

Strings

msi.dll, xrefs: 00BD10A0
clbcatq.dll, xrefs: 00BD10BC
version.dll, xrefs: 00BD10A7
comres.dll, xrefs: 00BD10B5
crypt32.dll, xrefs: 00BD10CA
cabinet.dll, xrefs: 00BD1099, 00BD1114
feclient.dll, xrefs: 00BD10D1
msasn1.dll, xrefs: 00BD10C3
wininet.dll, xrefs: 00BD10AE

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
API String ID: 3687706282-3151496603
Opcode ID: eb5abbc0218b7736fa7f1ea1975845c9dcbf7e137825e3a40ed92761f8d16a07
Instruction ID: 815165b70e7d7be6051e9946927458554e8e86e193281d83b9251ee058b5492e
Opcode Fuzzy Hash: eb5abbc0218b7736fa7f1ea1975845c9dcbf7e137825e3a40ed92761f8d16a07
Instruction Fuzzy Hash: B321A2B1901208ABDF10DFA8DC09BDEBBF8EB0A720F104556EA11B7280E7B059449BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BE9F8F Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50COMMON

Download Yara Rule

Strings

Failed to copy working folder., xrefs: 00BE9FEA
Failed to calculate working folder to ensure it exists., xrefs: 00BE9FAC
Failed create working folder., xrefs: 00BE9FC2

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CurrentDirectoryErrorLastProcessWindows
String ID: Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
API String ID: 3841436932-2072961686
Opcode ID: a8ee0becf9218ecce2d57bc0c6c6ea8cb30fe96befec54b8d5fb3f6dc83ef7bb
Instruction ID: 15649bb0d23c0db884ed51337eb2c258cc5a5d7414ff895254cd213c0073ee0b
Opcode Fuzzy Hash: a8ee0becf9218ecce2d57bc0c6c6ea8cb30fe96befec54b8d5fb3f6dc83ef7bb
Instruction Fuzzy Hash: A50184319055A4FB8F226B56ED06C9EBBF9DF91B2171181A6F800B6215EB319F40E6D0

Uniqueness

Uniqueness Score: -1.00%

Function 00BDF981 Relevance: 114.2, APIs: 3, Strings: 62, Instructions: 445
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

DisplayName, xrefs: 00BDFB1C
Invalid modify disabled type: %ls, xrefs: 00BDFD32
Failed to get @Comments., xrefs: 00BDFC5E
Failed to get @Version., xrefs: 00BDFA42
Tag, xrefs: 00BDF9F5
PerMachine, xrefs: 00BDFAB0
Failed to set registration paths., xrefs: 00BDFEA6
Manufacturer, xrefs: 00BDFDF1
HelpLink, xrefs: 00BDFB8B
Update, xrefs: 00BDFDBC
Registration, xrefs: 00BDF99B
Failed to select Update node., xrefs: 00BDFDDA
button, xrefs: 00BDFCB3
Failed to get @AboutUrl., xrefs: 00BDFBEC
Failed to get @Department., xrefs: 00BDFE2C
Failed to select registration node., xrefs: 00BDF9BA
Publisher, xrefs: 00BDFB66
Contact, xrefs: 00BDFC6F
Arp, xrefs: 00BDFAD1
Failed to get @UpdateUrl., xrefs: 00BDFC11
ProductFamily, xrefs: 00BDFE3A
Version, xrefs: 00BDFA2F
Failed to get @Tag., xrefs: 00BDFA08
ProviderKey, xrefs: 00BDFA71
Failed to get @ParentDisplayName., xrefs: 00BDFC36
yes, xrefs: 00BDFCD4
Failed to get @ExecutableName., xrefs: 00BDFAA5
Failed to get @Id., xrefs: 00BDF9E7
Failed to get @Contact., xrefs: 00BDFC86
Failed to get @Classification., xrefs: 00BDFE93
DisableModify, xrefs: 00BDFC94
Failed to get @ProductFamily., xrefs: 00BDFE51
Failed to get @DisableModify., xrefs: 00BDFD56
UpdateUrl, xrefs: 00BDFBFA
Failed to get @Name., xrefs: 00BDFE72
Comments, xrefs: 00BDFC47
AboutUrl, xrefs: 00BDFBD5
Classification, xrefs: 00BDFE80
Failed to get @DisplayVersion., xrefs: 00BDFB58
DisplayVersion, xrefs: 00BDFB41
Failed to get @DisplayName., xrefs: 00BDFB33
ExecutableName, xrefs: 00BDFA92
Failed to get @DisableRemove., xrefs: 00BDFD7E
HelpTelephone, xrefs: 00BDFBB0
c:\agent\_work\66\s\src\burn\engine\registration.cpp, xrefs: 00BDFD25
@, xrefs: 00BDFE7F
Failed to get @Manufacturer., xrefs: 00BDFE04
Department, xrefs: 00BDFE15
Register, xrefs: 00BDFAFB
Failed to get @Register., xrefs: 00BDFB0E
ParentDisplayName, xrefs: 00BDFC1F
Failed to get @ProviderKey., xrefs: 00BDFA84
Failed to parse software tag., xrefs: 00BDFDAE
Failed to parse @Version: %ls, xrefs: 00BDFA63
Failed to select ARP node., xrefs: 00BDFAED
Failed to parse related bundles, xrefs: 00BDFA21
Failed to get @HelpLink., xrefs: 00BDFBA2
Failed to get @HelpTelephone., xrefs: 00BDFBC7
DisableRemove, xrefs: 00BDFD67
Name, xrefs: 00BDFE5F
Failed to get @PerMachine., xrefs: 00BDFAC3
Failed to get @Publisher., xrefs: 00BDFB7D

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$c:\agent\_work\66\s\src\burn\engine\registration.cpp$yes$@
API String ID: 760788290-3384854740
Opcode ID: fdf3a42cba1d4e1e260fa4b7efe597b737839c4551c2f585c47528b20b0b5633
Instruction ID: d84470fe966fb406e8bc92c592461eb793f0c468aed2ed3b6b8f70211c3ad8ea
Opcode Fuzzy Hash: fdf3a42cba1d4e1e260fa4b7efe597b737839c4551c2f585c47528b20b0b5633
Instruction Fuzzy Hash: 5EE1C732E48637FBCB219A50DC41EBDF7A4AB05B10F2142B3BD16B77A2E7609D516680

Uniqueness

Uniqueness Score: -1.00%

Function 00BDB45A Relevance: 91.6, APIs: 24, Strings: 28, Instructions: 577
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB4D1
SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB51F
GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB525
ReadFile.KERNELBASE(00000000,00BD44B0,00000040,?,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB56D
GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB573
SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB5D0
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB5D6
ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB61F
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB625
SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB696
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB69C
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB6E5
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB6EB
ReadFile.KERNEL32(00000000,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB734
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB73A
SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB786
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB78C

Part of subcall function 00BD39DF: GetProcessHeap.KERNEL32(?,000001C7,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F0
Part of subcall function 00BD39DF: RtlAllocateHeap.NTDLL(00000000,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F7

ReadFile.KERNEL32(00000000,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB7DF
ReadFile.KERNEL32(00000000,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB841
SetFilePointerEx.KERNELBASE(00000000,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB8CB
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB8D5

Strings

Failed to seek to start of file., xrefs: 00BDB550
Failed to read signature size., xrefs: 00BDB765
4, xrefs: 00BDB853
Failed to find Burn section., xrefs: 00BDBB01
(, xrefs: 00BDB7EC
Failed to read section info, unsupported version: %08x, xrefs: 00BDB9C4
burn, xrefs: 00BDB807
Failed to allocate buffer for section info., xrefs: 00BDB8B3
Failed to read signature offset., xrefs: 00BDB716
Failed to read section info, data to short: %u, xrefs: 00BDB879
Failed to seek to section info., xrefs: 00BDB6C7, 00BDB903
Failed to read complete section info., xrefs: 00BDB994
c:\agent\_work\66\s\src\burn\engine\section.cpp, xrefs: 00BDB4F2, 00BDB546, 00BDB594, 00BDB5F7, 00BDB646, 00BDB6BD, 00BDB70C, 00BDB75B, 00BDB7B0, 00BDB867, 00BDB8A7, 00BDB8F9, 00BDB95E, 00BDB988, 00BDB9AF, 00BDBA96, 00BDBAD6, 00BDBAF5, 00BDBB32, 00BDBB70, 00BDBB93, 00BDBBAE
Failed to read section info., xrefs: 00BDB968
.wix, xrefs: 00BDB7FF
Failed to find valid DOS image header in buffer., xrefs: 00BDBBBA
PE Header from file didn't match PE Header in memory., xrefs: 00BDBAE0
Failed to allocate memory for container sizes., xrefs: 00BDBAA2
Failed to read DOS header., xrefs: 00BDB59E
Failed to seek to NT header., xrefs: 00BDB601
Failed to read NT header., xrefs: 00BDB650
Failed to read image section header, index: %u, xrefs: 00BDBB7B
Failed to seek past optional headers., xrefs: 00BDB7BA
Failed to get total size of bundle., xrefs: 00BDB9F2
Failed to read complete image section header, index: %u, xrefs: 00BDBB44
Failed to open handle to engine process path., xrefs: 00BDB4FC
PE, xrefs: 00BDB667
Failed to find valid NT image header in buffer., xrefs: 00BDBB9F

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$burn$c:\agent\_work\66\s\src\burn\engine\section.cpp
API String ID: 3411815225-1671293494
Opcode ID: 0ccaba8b897e5e0fa3f1764a3d21e5e92f89fe1f28e4940507611bee9aecfe6e
Instruction ID: e3b785ed4a90f1bf7dee70334e0d742259710c82058f1a93cf352089b60596af
Opcode Fuzzy Hash: 0ccaba8b897e5e0fa3f1764a3d21e5e92f89fe1f28e4940507611bee9aecfe6e
Instruction Fuzzy Hash: 9812F772940225EBDB209A548C46FEAB6E4EF05B10F0241E6FD05BB381F7799D80DBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00BF0ABB Relevance: 54.6, APIs: 20, Strings: 11, Instructions: 306
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetEvent.KERNEL32(?,?,?,?,?,00BF066B,?,?), ref: 00BF0ACA
GetLastError.KERNEL32(?,?,?,?,00BF066B,?,?), ref: 00BF0AD4
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,00BF066B,?,?), ref: 00BF0B19
GetLastError.KERNEL32(?,?,?,?,00BF066B,?,?), ref: 00BF0B24
ResetEvent.KERNEL32(?,?,?,?,?,00BF066B,?,?), ref: 00BF0B5C
GetLastError.KERNEL32(?,?,?,?,00BF066B,?,?), ref: 00BF0B66

Strings

Failed to set file pointer to beginning of file., xrefs: 00BF0E7D
Failed to set file pointer to end of file., xrefs: 00BF0DF4
Failed to create file: %ls, xrefs: 00BF0DA6
Failed to set operation complete event., xrefs: 00BF0B02, 00BF0C43
Failed to allocate buffer for stream., xrefs: 00BF0D38
Invalid operation for this state., xrefs: 00BF0BC2
Failed to reset begin operation event., xrefs: 00BF0B94, 00BF0CD0
Failed to set end of file., xrefs: 00BF0E39
Failed to copy stream name: %ls, xrefs: 00BF0BF5
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00BF0AF8, 00BF0B48, 00BF0B8A, 00BF0BB6, 00BF0C39, 00BF0C81, 00BF0CC6, 00BF0D2E, 00BF0D99, 00BF0DEA, 00BF0E2F, 00BF0E73
Failed to wait for begin operation event., xrefs: 00BF0B52, 00BF0C8B

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$Event$ObjectResetSingleWait
String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 1865021742-1830388895
Opcode ID: 79647356ef7c1eb9ed1c8af81149e1739d55b6e65136bb9e1fbb4f90f720322e
Instruction ID: 605dd367601dabf21a1b1c95fad70dd961189d149e038fcc0d8185cf213e1c86
Opcode Fuzzy Hash: 79647356ef7c1eb9ed1c8af81149e1739d55b6e65136bb9e1fbb4f90f720322e
Instruction Fuzzy Hash: ED912B37DA563A77D32026A45E49B7669D0FF04B20F0242B0FF05BB6E3E669DC0496D1

Uniqueness

Uniqueness Score: -1.00%

Function 00BD4D7A Relevance: 38.7, APIs: 6, Strings: 16, Instructions: 219
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BD34C4: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,00BD10DD,?,00000000), ref: 00BD34E5

CloseHandle.KERNEL32(00000000,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00BD4F81
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00BD4F90
CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00BD4F9F
CloseHandle.KERNEL32(?,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00BD4FAA

Strings

%ls %ls, xrefs: 00BD4E96
burn.clean.room, xrefs: 00BD4E1F
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 00BD4F2B
-%ls="%ls", xrefs: 00BD4E27
burn.filehandle.self, xrefs: 00BD4E86
D, xrefs: 00BD4EEA
Failed to allocate parameters for unelevated process., xrefs: 00BD4E3B
Failed to get path for current process., xrefs: 00BD4DC4
Failed to wait for clean room process: %ls, xrefs: 00BD4F64
"%ls" %ls, xrefs: 00BD4EBB
Failed to cache to clean room., xrefs: 00BD4E03
Failed to launch clean room process: %ls, xrefs: 00BD4F38
Failed to append %ls, xrefs: 00BD4E5D
Failed to append original command line., xrefs: 00BD4EAA
burn.filehandle.attached, xrefs: 00BD4E58
Failed to allocate full command-line., xrefs: 00BD4ECF

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseHandle$FileModuleName
String ID: "%ls" %ls$%ls %ls$-%ls="%ls"$D$Failed to allocate full command-line.$Failed to allocate parameters for unelevated process.$Failed to append %ls$Failed to append original command line.$Failed to cache to clean room.$Failed to get path for current process.$Failed to launch clean room process: %ls$Failed to wait for clean room process: %ls$burn.clean.room$burn.filehandle.attached$burn.filehandle.self$c:\agent\_work\66\s\src\burn\engine\engine.cpp
API String ID: 3884789274-3026910944
Opcode ID: c90c8298fa48358a23ca6f738380bfb44b4e46bbc9a67b89d7e7c257de3fd884
Instruction ID: 8c9559880ddba9c07cebfa54fac28e686dd14ee3bf3142ac0650f1c85d96f3aa
Opcode Fuzzy Hash: c90c8298fa48358a23ca6f738380bfb44b4e46bbc9a67b89d7e7c257de3fd884
Instruction Fuzzy Hash: A7718132D01229BBCB119BA4CC41AEFFBB8AF05720F1141A6F914B6391E7755A41DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00BE741D Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to load manifest., xrefs: 00BE74DB
Failed to get source process folder from path., xrefs: 00BE7618
Failed to get unique temporary folder for bootstrapper application., xrefs: 00BE76C1
WixBundleSourceProcessPath, xrefs: 00BE75EB
Failed to open attached UX container., xrefs: 00BE7481
WixBundleOriginalSource, xrefs: 00BE764C
WixBundleSourceProcessFolder, xrefs: 00BE7627
WixBundleUILevel, xrefs: 00BE75C9, 00BE75DA
Failed to initialize internal cache functionality., xrefs: 00BE7692
Failed to load catalog files., xrefs: 00BE7702
Failed to parse command line., xrefs: 00BE755A
Failed to set source process folder variable., xrefs: 00BE7638
Failed to set source process path variable., xrefs: 00BE75FC
Failed to open manifest stream., xrefs: 00BE749E
Failed to extract bootstrapper application payloads., xrefs: 00BE76E2
WixBundleElevated, xrefs: 00BE7598, 00BE75A9
Failed to initialize variables., xrefs: 00BE7464
Failed to overwrite the %ls built-in variable., xrefs: 00BE75AE
Failed to get manifest stream from container., xrefs: 00BE74BF
Failed to set original source variable., xrefs: 00BE765D

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel
API String ID: 32694325-1564579409
Opcode ID: cd467f7e11bb8995b371bf8ec10ffaaf53c8be005ceddc65fe161addd817bc99
Instruction ID: acc3b52692321fa592eb23c0182ade63bfa3fdc87431a9ed794963132fa7ca66
Opcode Fuzzy Hash: cd467f7e11bb8995b371bf8ec10ffaaf53c8be005ceddc65fe161addd817bc99
Instruction Fuzzy Hash: 79A16572E84656BBCF129AA5DC81EEEB7ECBB14700F1042A6F505E7241EB70ED548BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00BE85B1 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 208
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,40000000,00000005,00000000,00000002,08000080,00000000,?,00000000,00000000,00BD4DFD,?,?,00000000,00BD4DFD,00000000), ref: 00BE85F4
GetLastError.KERNEL32 ref: 00BE8601

Part of subcall function 00C13709: ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00C1379F

SetFilePointerEx.KERNELBASE(00000000,00C1A4B8,00000000,00000000,00000000,?,00000000,00C1A500,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BE86AE
GetLastError.KERNEL32 ref: 00BE86B8
FindCloseChangeNotification.KERNELBASE(00000000,?,00000000,00C1A500,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BE87E3

Strings

msi.dll, xrefs: 00BE86F5
Failed to create engine file at path: %ls, xrefs: 00BE8632
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00BE8625, 00BE86DC, 00BE8743, 00BE87B2
Failed to seek to beginning of engine file: %ls, xrefs: 00BE865A
Failed to seek to original data in exe burn section header., xrefs: 00BE87BC
Failed to seek to checksum in exe header., xrefs: 00BE86E6
Failed to seek to signature table in exe header., xrefs: 00BE874D
Failed to zero out original data offset., xrefs: 00BE87D5
Failed to update signature offset., xrefs: 00BE8702
cabinet.dll, xrefs: 00BE875C
Failed to copy engine from: %ls to: %ls, xrefs: 00BE8689

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: File$ErrorLast$ChangeCloseCreateFindNotificationPointerRead
String ID: Failed to copy engine from: %ls to: %ls$Failed to create engine file at path: %ls$Failed to seek to beginning of engine file: %ls$Failed to seek to checksum in exe header.$Failed to seek to original data in exe burn section header.$Failed to seek to signature table in exe header.$Failed to update signature offset.$Failed to zero out original data offset.$c:\agent\_work\66\s\src\burn\engine\cache.cpp$cabinet.dll$msi.dll
API String ID: 3608016165-3887126093
Opcode ID: 3539bc8e1b700c363ece1b29b41345c6e0a1935973556a12def5580fa1f25986
Instruction ID: 3e9ee0398ceaf74c7f7e6972861ee803307e80b20c38f520b9539c18df241dca
Opcode Fuzzy Hash: 3539bc8e1b700c363ece1b29b41345c6e0a1935973556a12def5580fa1f25986
Instruction Fuzzy Hash: C451F9B3941971BFE7216B659C46FBF76A8EB05B10F1141A4FE05FB281EB25CC0096E2

Uniqueness

Uniqueness Score: -1.00%

Function 00BD762D Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 419
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00BE745E,00BD53FA,00000000,00BD5482), ref: 00BD764D

Strings

WixBundleTag, xrefs: 00BD7EAF
WixBundleExecutePackageCacheFolder, xrefs: 00BD7D99
', xrefs: 00BD78EC
WixBundleAction, xrefs: 00BD7D77
WixBundleVersion, xrefs: 00BD7ECF
WixBundleSourceProcessPath, xrefs: 00BD7E8F
#, xrefs: 00BD76CC
Failed to add built-in variable: %ls., xrefs: 00BD7F1A
0, xrefs: 00BD7664
WixBundleForcedRestartPackage, xrefs: 00BD7E15
WixBundleSourceProcessFolder, xrefs: 00BD7E9F
WixBundleInstalled, xrefs: 00BD7E2B
WixBundleProviderKey, xrefs: 00BD7E7F
InstallerName, xrefs: 00BD7813
WixBundleUILevel, xrefs: 00BD7EBF
$, xrefs: 00BD7D4A
LogonUser, xrefs: 00BD7883
Date, xrefs: 00BD7771
WixBundleActiveParent, xrefs: 00BD7E63
InstallerVersion, xrefs: 00BD7834
WixBundleElevated, xrefs: 00BD7E47
WixBundleExecutePackageAction, xrefs: 00BD7DF9

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion
API String ID: 32694325-3635313340
Opcode ID: fdda8ad4e9b47e1447a47f300cbab9c565b62222d3dd8d5b7201b12ab9d9dd8d
Instruction ID: 9e9473c87ab9944246576578fa7dd8c158dccb46899f4bcb6acff35fa5ed314f
Opcode Fuzzy Hash: fdda8ad4e9b47e1447a47f300cbab9c565b62222d3dd8d5b7201b12ab9d9dd8d
Instruction Fuzzy Hash: 873234F1D116699BDB658F5AC9883CDFAF4BB49304F9081EED20CAA211D7B00EC99F45

Uniqueness

Uniqueness Score: -1.00%

Function 00BE819F Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00BD54C6), ref: 00BE81F5

Part of subcall function 00C10141: OpenProcessToken.ADVAPI32(?,00000008,?,00BD53FA,00000000,?,?,?,?,?,?,?,00BE7590,00000000), ref: 00C1015F
Part of subcall function 00C10141: GetLastError.KERNEL32(?,?,?,?,?,?,?,00BE7590,00000000), ref: 00C10169
Part of subcall function 00C10141: FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00BE7590,00000000), ref: 00C101F3

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 00BE821B
GetLastError.KERNEL32 ref: 00BE8225
GetTempPathW.KERNEL32(00000104,?,00000000), ref: 00BE82A2
GetLastError.KERNEL32 ref: 00BE82AC
UuidCreate.RPCRT4(?), ref: 00BE82EB

Strings

Failed to create working folder guid., xrefs: 00BE82F8
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00BE8249, 00BE82D0, 00BE8321
Failed to append bundle id on to temp path for working folder., xrefs: 00BE8355
Temp\, xrefs: 00BE827A
Failed to get windows path for working folder., xrefs: 00BE8253
%ls%ls\, xrefs: 00BE833D
Failed to convert working folder guid into string., xrefs: 00BE832B
Failed to copy working folder path., xrefs: 00BE8370
Failed to concat Temp directory on windows path for working folder., xrefs: 00BE8292
Failed to ensure windows path for working folder ended in backslash., xrefs: 00BE8270
Failed to get temp path for working folder., xrefs: 00BE82DA

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$Process$ChangeCloseCreateCurrentDirectoryFindNotificationOpenPathTempTokenUuidWindows
String ID: %ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 2898636500-2821718772
Opcode ID: 43f7b1d86350120579a5194ba14366286c34c96250aec2fdbbbb68a3cf4ee9ef
Instruction ID: 97d524d9289cf175f1a92b536567b42986d9e5e4f54dac3b1b295f8c7640ce4a
Opcode Fuzzy Hash: 43f7b1d86350120579a5194ba14366286c34c96250aec2fdbbbb68a3cf4ee9ef
Instruction Fuzzy Hash: 6F410B72E41A74B7DB2096F19C4AFAF73E8AB00B11F1042E1BA09F7141EB75DD4486A5

Uniqueness

Uniqueness Score: -1.00%

Function 00BF0EA0 Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 00BF0EC2
CoUninitialize.OLE32 ref: 00BF113D

Strings

Failed to initialize COM., xrefs: 00BF0ECE
Failed to set operation complete event., xrefs: 00BF1069
Invalid operation for this state., xrefs: 00BF1121
Failed to reset begin operation event., xrefs: 00BF10F5
<the>.cab, xrefs: 00BF0F62
Failed to initialize cabinet.dll., xrefs: 00BF0F44
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00BF0F38, 00BF105F, 00BF10AC, 00BF10EB, 00BF1117
Failed to extract all files from container, erf: %d:%X:%d, xrefs: 00BF101E
Failed to wait for begin operation event., xrefs: 00BF10B6

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: InitializeUninitialize
String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 3442037557-964446333
Opcode ID: 5ddf5f654087a09ed0c164299b9dea6c4447b712064a1745e7466decb06711c4
Instruction ID: 8f65e86ec802aa4d8ffe4efa2d2a3c5c1a27148cbe41e966ae569bb708911aad
Opcode Fuzzy Hash: 5ddf5f654087a09ed0c164299b9dea6c4447b712064a1745e7466decb06711c4
Instruction Fuzzy Hash: 01519E37D4127AE7C72056BC9C41A7A75D4DB01B20F224EE5BF01BB292D92A8C48A6D1

Uniqueness

Uniqueness Score: -1.00%

Function 00BD4326 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 157
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,00BD52A3,?,?,00000000,?,?), ref: 00BD4352
InitializeCriticalSection.KERNEL32(000000D0,?,?,00BD52A3,?,?,00000000,?,?), ref: 00BD435B
lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,00BD52A3,?,?,00000000,?,?), ref: 00BD43A1
lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,00BD52A3,?,?,00000000,?,?), ref: 00BD43AB
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00BD52A3,?,?,00000000,?,?), ref: 00BD43BF
lstrlenW.KERNEL32(burn.filehandle.attached,?,?,00BD52A3,?,?,00000000,?,?), ref: 00BD43CF
lstrlenW.KERNEL32(burn.filehandle.self,?,?,00BD52A3,?,?,00000000,?,?), ref: 00BD441F
lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,00BD52A3,?,?,00000000,?,?), ref: 00BD4429
CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,00BD52A3,?,?,00000000,?,?), ref: 00BD443D
lstrlenW.KERNEL32(burn.filehandle.self,?,?,00BD52A3,?,?,00000000,?,?), ref: 00BD444D

Strings

Failed to initialize engine section., xrefs: 00BD44B6
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 00BD44E2, 00BD450E
Failed to parse file handle: '%ls', xrefs: 00BD44CF
burn.filehandle.attached, xrefs: 00BD439C, 00BD43A4, 00BD43A9, 00BD43AA, 00BD43CA, 00BD44EC
burn.filehandle.self, xrefs: 00BD441A, 00BD4422, 00BD4427, 00BD4428, 00BD4448, 00BD4518
Missing required parameter for switch: %ls, xrefs: 00BD44F1

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: lstrlen$CompareCriticalInitializeSectionString
String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$c:\agent\_work\66\s\src\burn\engine\engine.cpp
API String ID: 3039292287-2540856168
Opcode ID: afbbb7379e7ecbed11a0130508d2850dbd8b92f254b88fc538533e59f6fd6102
Instruction ID: e204396435a907989908b737c0b196aaa8d304a0435285e002ae7ae8d65f9e70
Opcode Fuzzy Hash: afbbb7379e7ecbed11a0130508d2850dbd8b92f254b88fc538533e59f6fd6102
Instruction Fuzzy Hash: A751F471A41211BFC7249B68DC86F9EB7A8FF02720F104166F608D7391EB74A990DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00BDC252 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 131
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,?,00BDC442,00BD5442,?,?,00BD5482), ref: 00BDC299
GetLastError.KERNEL32(?,00BDC442,00BD5442,?,?,00BD5482,00BD5482,00000000,?,00000000), ref: 00BDC2AA
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,?,00BDC442,00BD5442,?,?,00BD5482,00BD5482,00000000,?), ref: 00BDC2F9
GetCurrentProcess.KERNEL32(000000FF,00000000,?,00BDC442,00BD5442,?,?,00BD5482,00BD5482,00000000,?,00000000), ref: 00BDC2FF
DuplicateHandle.KERNELBASE(00000000,?,00BDC442,00BD5442,?,?,00BD5482,00BD5482,00000000,?,00000000), ref: 00BDC302
GetLastError.KERNEL32(?,00BDC442,00BD5442,?,?,00BD5482,00BD5482,00000000,?,00000000), ref: 00BDC30C
SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,00BDC442,00BD5442,?,?,00BD5482,00BD5482,00000000,?,00000000), ref: 00BDC35E
GetLastError.KERNEL32(?,00BDC442,00BD5442,?,?,00BD5482,00BD5482,00000000,?,00000000), ref: 00BDC368

Strings

c:\agent\_work\66\s\src\burn\engine\container.cpp, xrefs: 00BDC2CE, 00BDC330, 00BDC38C
Failed to duplicate handle to container: %ls, xrefs: 00BDC33D
Failed to move file pointer to container offset., xrefs: 00BDC396
Failed to open container., xrefs: 00BDC3B4
crypt32.dll, xrefs: 00BDC35A
Failed to open file: %ls, xrefs: 00BDC2DB
feclient.dll, xrefs: 00BDC35B

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$c:\agent\_work\66\s\src\burn\engine\container.cpp$crypt32.dll$feclient.dll
API String ID: 2619879409-1064011499
Opcode ID: dde9016a78358208e822de8a8856eef94e1f4b4a41bdebf1671a0644edfab81d
Instruction ID: a860feff171e37bafe66d8f22179206bf81bdf6d65064954512b028b76bbd3d9
Opcode Fuzzy Hash: dde9016a78358208e822de8a8856eef94e1f4b4a41bdebf1671a0644edfab81d
Instruction Fuzzy Hash: E841C636140212ABDB209F599D45F5BBEE5EBC5720F2180AAFD14EB382F635C801EB65

Uniqueness

Uniqueness Score: -1.00%

Function 00C12368 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 78
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BD38D1: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00BD3910
Part of subcall function 00BD38D1: GetLastError.KERNEL32 ref: 00BD391A

Part of subcall function 00C14289: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00C142BA

GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 00C123B2
GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 00C123D2
GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 00C123F2
GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00C12412
GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00C12432
GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00C12452
GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00C12472

Strings

MsiGetProductInfoExW, xrefs: 00C12427
MsiDeterminePatchSequenceW, xrefs: 00C123A7
Msi.dll, xrefs: 00C1237A
MsiSourceListAddSourceExW, xrefs: 00C12467
MsiDetermineApplicablePatchesW, xrefs: 00C123C7
MsiEnumProductsExW, xrefs: 00C123E7
MsiGetPatchInfoExW, xrefs: 00C12407
MsiSetExternalUIRecord, xrefs: 00C12447

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AddressProc$ErrorLast$DirectorySystem
String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
API String ID: 2510051996-1735120554
Opcode ID: b49e6ddba4c2b30a14488352810d1388691d496eb8e32e52adb93ce63d6362a6
Instruction ID: 8b909f20b5905d367587a6f7f223ec370e776d45527b199d07b11c2583ed256d
Opcode Fuzzy Hash: b49e6ddba4c2b30a14488352810d1388691d496eb8e32e52adb93ce63d6362a6
Instruction Fuzzy Hash: 5831F7B0921A48EBD7199F60EE07B9DBBF0E751708F10413AF20056572E7754EA4EF40

Uniqueness

Uniqueness Score: -1.00%

Function 00BF14E3 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,00BDC3AE,?,00000000,?,00BDC442), ref: 00BF151A
GetLastError.KERNEL32(?,00BDC3AE,?,00000000,?,00BDC442,00BD5442,?,?,00BD5482,00BD5482,00000000,?,00000000), ref: 00BF1523

Strings

Failed to create extraction thread., xrefs: 00BF15E3
Failed to wait for operation complete., xrefs: 00BF15F6
Failed to create operation complete event., xrefs: 00BF1597
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00BF1547, 00BF158D, 00BF15D9
Failed to create begin operation event., xrefs: 00BF1551
wininet.dll, xrefs: 00BF14F9
Failed to copy file name., xrefs: 00BF1505

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp$wininet.dll
API String ID: 545576003-1014644744
Opcode ID: c9d6c367888bb1ad82dc5e11187acdd9a86fb9a50ee262ef1b0646401557dab2
Instruction ID: 2e7bc80f1286ff64eafec0098650d4900f7bee6875e1bcbb9ae21803383c4a88
Opcode Fuzzy Hash: c9d6c367888bb1ad82dc5e11187acdd9a86fb9a50ee262ef1b0646401557dab2
Instruction Fuzzy Hash: E8214973D8163FB7E22012AC5C41F7B69DCEF54BA0F024DA1BE02BB681E668DC0452E1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0F58A Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 00C0F5B2
GetProcAddress.KERNEL32(SystemFunction041), ref: 00C0F5C4
GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 00C0F607
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00C0F61B
GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 00C0F653
GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00C0F667

Strings

CryptProtectMemory, xrefs: 00C0F5FC
AdvApi32.dll, xrefs: 00C0F591
Crypt32.dll, xrefs: 00C0F5E8
c:\agent\_work\66\s\src\libs\dutil\cryputil.cpp, xrefs: 00C0F63C
CryptUnprotectMemory, xrefs: 00C0F648
SystemFunction041, xrefs: 00C0F5B4
SystemFunction040, xrefs: 00C0F5A7

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$c:\agent\_work\66\s\src\libs\dutil\cryputil.cpp
API String ID: 4214558900-686287438
Opcode ID: b6b12d139d07a6c4cccb1c047cc2648f072de0c677d7996dc9f60a64e6225b5f
Instruction ID: 343ef336d9078207e3e85e0b276030a076afbb452acbad301fa8110fa6a9b4d5
Opcode Fuzzy Hash: b6b12d139d07a6c4cccb1c047cc2648f072de0c677d7996dc9f60a64e6225b5f
Instruction Fuzzy Hash: 9021A732961631ABD7319B559C0571A7A90BB04B50F02023EFE11B76F0E7768D82EFD0

Uniqueness

Uniqueness Score: -1.00%

Function 00BF0671 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 00BF06A1
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 00BF06B9
GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 00BF06BE
DuplicateHandle.KERNELBASE(00000000,?,?), ref: 00BF06C1
GetLastError.KERNEL32(?,?), ref: 00BF06CB
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 00BF073A
GetLastError.KERNEL32(?,?), ref: 00BF0747

Strings

Failed to add virtual file pointer for cab container., xrefs: 00BF0720
Failed to duplicate handle to cab container., xrefs: 00BF06F9
Failed to open cabinet file: %hs, xrefs: 00BF0778
<the>.cab, xrefs: 00BF069A
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00BF06EF, 00BF076B

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 3030546534-886985619
Opcode ID: 3a5439730de8ca4e18abdb7315c56bd4684f858359c4f26cb6f87f2d20e299ff
Instruction ID: d356acb520630e4842627a6029a322262d33831cd5471b051c4ed0cff4904d78
Opcode Fuzzy Hash: 3a5439730de8ca4e18abdb7315c56bd4684f858359c4f26cb6f87f2d20e299ff
Instruction Fuzzy Hash: C231F23291213ABBD7216B549D49FAF7EA8FF05760F1141A1FE04B7262D634AC009BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00BE6955 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000000FF,00000000,00000001,00000002,?,00000000,?,?,00BD4E52,?,?), ref: 00BE6975
GetCurrentProcess.KERNEL32(?,00000000,?,?,00BD4E52,?,?), ref: 00BE697B
DuplicateHandle.KERNELBASE(00000000,?,?,00BD4E52,?,?), ref: 00BE697E
GetLastError.KERNEL32(?,?,00BD4E52,?,?), ref: 00BE6988
CloseHandle.KERNEL32(000000FF,?,00BD4E52,?,?), ref: 00BE6A01

Strings

Failed to append the file handle to the command line., xrefs: 00BE69E9
%ls -%ls=%u, xrefs: 00BE69D5
c:\agent\_work\66\s\src\burn\engine\core.cpp, xrefs: 00BE69AC
burn.filehandle.attached, xrefs: 00BE69CE
Failed to duplicate file handle for attached container., xrefs: 00BE69B6

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CurrentHandleProcess$CloseDuplicateErrorLast
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to duplicate file handle for attached container.$burn.filehandle.attached$c:\agent\_work\66\s\src\burn\engine\core.cpp
API String ID: 4224961946-3213253029
Opcode ID: 6f9e132b547263e4f0ce1df4259765af9ac8acea4b4005fd1decd228fcecb023
Instruction ID: b907e0c8754d5ff6cd8329e2a3799f5d9788954e8f42538d73a8e2eb35c6389a
Opcode Fuzzy Hash: 6f9e132b547263e4f0ce1df4259765af9ac8acea4b4005fd1decd228fcecb023
Instruction Fuzzy Hash: 6F112932941221F7CB109BA99D05F9EBBE8AF15B70F1143A1F911F72D1E7749E009690

Uniqueness

Uniqueness Score: -1.00%

Function 00C1919D Relevance: 15.1, APIs: 10, Instructions: 135libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExA.KERNELBASE(?,00000000,00000000), ref: 00C191BE
GetLastError.KERNEL32 ref: 00C191CA
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00C191F9
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 00C1920A
FreeLibrary.KERNEL32(00000000), ref: 00C19224
GetProcAddress.KERNEL32(00000000,?), ref: 00C1928C
GetLastError.KERNEL32 ref: 00C19298
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00C192C7
RaiseException.KERNEL32(C06D007F,00000000,00000001,?), ref: 00C192D8
DloadReleaseSectionWriteAccess.DELAYIMP ref: 00C1930F

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AccessDloadReleaseSectionWrite$ErrorExceptionLastLibraryRaise$AddressFreeLoadProc
String ID:
API String ID: 202095176-0
Opcode ID: ca605983979b8e59f8f04d66f193dbc321eae53ed0dca6fcb91528df5bb35363
Instruction ID: 7086762dad4f5cb685df97a4cf196b17a7d695be8be4687d989d2794e9da5229
Opcode Fuzzy Hash: ca605983979b8e59f8f04d66f193dbc321eae53ed0dca6fcb91528df5bb35363
Instruction Fuzzy Hash: A941BF31A0121AAFCB21DF90D8A4BEDB7B5FF4A350F554029E921A7220DB70DE80DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C10141 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,?,00BD53FA,00000000,?,?,?,?,?,?,?,00BE7590,00000000), ref: 00C1015F
GetLastError.KERNEL32(?,?,?,?,?,?,?,00BE7590,00000000), ref: 00C10169
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,00BE7590,00000000), ref: 00C1019B
GetLastError.KERNEL32(?,?,?,?,?,?,?,00BE7590,00000000), ref: 00C101B4
FindCloseChangeNotification.KERNELBASE(?,?,?,?,?,?,?,?,00BE7590,00000000), ref: 00C101F3

Strings

c:\agent\_work\66\s\src\libs\dutil\procutil.cpp, xrefs: 00C101E1

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLastToken$ChangeCloseFindInformationNotificationOpenProcess
String ID: c:\agent\_work\66\s\src\libs\dutil\procutil.cpp
API String ID: 3650908616-2457365779
Opcode ID: 35b6d8827e911cd9a7bd1a6b5a638fff3357a9422c1488c02d58afb4860dbcbc
Instruction ID: 1169ffff22ae7fafb5af477c14792d756e6cfd694e4ef6f136739f3691f49f7a
Opcode Fuzzy Hash: 35b6d8827e911cd9a7bd1a6b5a638fff3357a9422c1488c02d58afb4860dbcbc
Instruction Fuzzy Hash: 60219276D41125FBCB219B958D08BDEBAB8BF06750F318056ED15BB250D2B88FC0EAD1

Uniqueness

Uniqueness Score: -1.00%

Function 00BE6A0F Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 68fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000005,?,00000003,00000080,00000000,?,00000000,?,?,?), ref: 00BE6A43
CloseHandle.KERNEL32(00000000), ref: 00BE6AB3

Strings

Failed to append the file handle to the obfuscated command line., xrefs: 00BE6AA1
Failed to append the file handle to the command line., xrefs: 00BE6A6F
%ls -%ls=%u, xrefs: 00BE6A5B, 00BE6A8D
burn.filehandle.self, xrefs: 00BE6A54, 00BE6A86

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseCreateFileHandle
String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to append the file handle to the obfuscated command line.$burn.filehandle.self
API String ID: 3498533004-3263533295
Opcode ID: adcddfb4d2ea321e98eb40e0ff7c67311b649f795460bac81059cd8192a85c61
Instruction ID: 0c8df556d16a453505956ee01396b6e154304015f6925c7f5302fee1d4ce88bc
Opcode Fuzzy Hash: adcddfb4d2ea321e98eb40e0ff7c67311b649f795460bac81059cd8192a85c61
Instruction Fuzzy Hash: B111E631A41260BBCB219BA9DD45F9F3BE8AB52B70F118366F921B72D1D37045018691

Uniqueness

Uniqueness Score: -1.00%

Function 00C12DC7 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00C12DD6
InterlockedIncrement.KERNEL32(00C3B69C), ref: 00C12DF3
CLSIDFromProgID.OLE32(Msxml2.DOMDocument,00C3B688,?,?,?,?,?,?), ref: 00C12E0E
CLSIDFromProgID.OLE32(MSXML.DOMDocument,00C3B688,?,?,?,?,?,?), ref: 00C12E1A

Strings

MSXML.DOMDocument, xrefs: 00C12E15
Msxml2.DOMDocument, xrefs: 00C12E09

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: FromProg$IncrementInitializeInterlocked
String ID: MSXML.DOMDocument$Msxml2.DOMDocument
API String ID: 2109125048-2356320334
Opcode ID: a35d080d464bfbbbff6ba98ab426a0140de8f54585b4d585df921874a6fab490
Instruction ID: d07bfc57b538b7867071c2d283fefcd2d78f7579449d04aeb034fd8aa150944a
Opcode Fuzzy Hash: a35d080d464bfbbbff6ba98ab426a0140de8f54585b4d585df921874a6fab490
Instruction Fuzzy Hash: 57F0A0787951359BD7211761AC09F8F2E7AAB93B52F801025F901C10A1C36488D1DAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C14289 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000001), ref: 00C142BA
GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 00C142E7
GetLastError.KERNEL32(?,00000000,?,00000000), ref: 00C14313
GetLastError.KERNEL32(00000000,00C1A800,?,00000000,?,00000000,?,00000000), ref: 00C14351
GlobalFree.KERNEL32(00000000), ref: 00C14382

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 00C142D5, 00C1432E

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$Global$AllocFree
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 1145190524-1688708105
Opcode ID: 25cf316b788c233ca8f81753138e01004eadc16aeda35744ff2fe576efdb4ab1
Instruction ID: 5a013de276ac4178468bd67b7bbce4db787aa21345a08ae3aeb0a286e39a9657
Opcode Fuzzy Hash: 25cf316b788c233ca8f81753138e01004eadc16aeda35744ff2fe576efdb4ab1
Instruction Fuzzy Hash: 0B31F636D00236ABC7159B958C01FEFBAB5BF46760F114261FC24E7251D630CD81A6E0

Uniqueness

Uniqueness Score: -1.00%

Function 00BF082C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 101COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 00BF08D2
GetLastError.KERNEL32(?,?,?), ref: 00BF08DC

Strings

Invalid seek type., xrefs: 00BF0868
Failed to move file pointer 0x%x bytes., xrefs: 00BF090D
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00BF0900

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2976181284-424406494
Opcode ID: b249ba9ecf3f2e501e47cbfd86489f1f11909ba2ba5afe811f5a8cb444213360
Instruction ID: bbacb515bc1d613fbd1d82f7ef0cb0969dfe52075bedbf96a613f86dc94f056b
Opcode Fuzzy Hash: b249ba9ecf3f2e501e47cbfd86489f1f11909ba2ba5afe811f5a8cb444213360
Instruction Fuzzy Hash: CD31C071A1011EEFCB00DFA8DD81EADB7A8FB04764B0481A5FA14A7662E374E914CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00BD415F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,00BE9FBC,00000000,00000000,?,00000000,00BD53FA,00000000,?,?,00BDD567,?), ref: 00BD416D
GetLastError.KERNEL32(?,00BE9FBC,00000000,00000000,?,00000000,00BD53FA,00000000,?,?,00BDD567,?,00000000,00000000), ref: 00BD417B
CreateDirectoryW.KERNEL32(?,840F01E8,00BD54C6,?,00BE9FBC,00000000,00000000,?,00000000,00BD53FA,00000000,?,?,00BDD567,?,00000000), ref: 00BD41EB
GetLastError.KERNEL32(?,00BE9FBC,00000000,00000000,?,00000000,00BD53FA,00000000,?,?,00BDD567,?,00000000,00000000), ref: 00BD41F5

Strings

c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp, xrefs: 00BD4225

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp
API String ID: 1375471231-2061300336
Opcode ID: fd35fcdf16c93d51127e22dd7455f7e662492567f132c49202dec7338cc6f185
Instruction ID: bff91f65eb056d7a32b278321a634659be5a6ff744427f2442277a5e5eca3183
Opcode Fuzzy Hash: fd35fcdf16c93d51127e22dd7455f7e662492567f132c49202dec7338cc6f185
Instruction Fuzzy Hash: 9A210426650231E7DB211AA15C84B7BEAE5EF66B60F1240A7FD44FA340F3348C4192D1

Uniqueness

Uniqueness Score: -1.00%

Function 00BD56E2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,00BD65B1,00BD65B1,?,00BD5678,?,?,00000000), ref: 00BD571E
GetLastError.KERNEL32(?,00BD5678,?,?,00000000,?,?,00BD65B1,?,00BD7F03,?,?,?,?,?), ref: 00BD574D

Strings

Failed to compare strings., xrefs: 00BD577B
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00BD5771
version.dll, xrefs: 00BD5710

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CompareErrorLastString
String ID: Failed to compare strings.$c:\agent\_work\66\s\src\burn\engine\variable.cpp$version.dll
API String ID: 1733990998-1548471634
Opcode ID: 081f11028120a7482978644374305931457eed9080d8aa47867e7a1704a99247
Instruction ID: 906c70fc8da67ab6d006c343be6b497beda11a886399d40845b71e23edfcc4ef
Opcode Fuzzy Hash: 081f11028120a7482978644374305931457eed9080d8aa47867e7a1704a99247
Instruction Fuzzy Hash: 7421D736641525EBC7258F98CD45A99FBE4FF06770B35039AE911AB3C0F634ED019AA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BF0797 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 54fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF11B1: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00BF07C6,?,?,?), ref: 00BF11D9
Part of subcall function 00BF11B1: GetLastError.KERNEL32(?,00BF07C6,?,?,?), ref: 00BF11E3

ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 00BF07D4
GetLastError.KERNEL32 ref: 00BF07DE

Strings

Failed to read during cabinet extraction., xrefs: 00BF080C
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00BF0802

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read during cabinet extraction.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2170121939-3499834177
Opcode ID: a9ad6194e9533437ad3f281c8de2dd33a24c13c603506a0e4279a85e9a67cbf7
Instruction ID: 3705d5e25b23c445a2e0150332e289017ddae4abaf9ac73fcc2b3450b2f24fa9
Opcode Fuzzy Hash: a9ad6194e9533437ad3f281c8de2dd33a24c13c603506a0e4279a85e9a67cbf7
Instruction Fuzzy Hash: 4401C232A40269EBCB11AF54ED04E9E7BA8FF05B64F0141A4FE04A7251D234D910DBD4

Uniqueness

Uniqueness Score: -1.00%

Function 00BF11B1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,00BF07C6,?,?,?), ref: 00BF11D9
GetLastError.KERNEL32(?,00BF07C6,?,?,?), ref: 00BF11E3

Strings

Failed to move to virtual file pointer., xrefs: 00BF1211
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00BF1207

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2976181284-1387633737
Opcode ID: d83f28b564750c93be43a787b2e36f1f52b532a093928723eaec5302b12c0565
Instruction ID: 6267aefff8a2c52c1c31b1992648154e178a6fde5f2d2369c8f66f6c02f81900
Opcode Fuzzy Hash: d83f28b564750c93be43a787b2e36f1f52b532a093928723eaec5302b12c0565
Instruction Fuzzy Hash: BF01D43290113AB797211A9AAC04A9BBF98FF01770701C965FE18A7501D636DC1096D0

Uniqueness

Uniqueness Score: -1.00%

Function 00C13709 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 00C1379F
GetLastError.KERNEL32 ref: 00C13802

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 00C13826

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 1948546556-1688708105
Opcode ID: 4805e2b42d056b3b2d7b2bd722e5615b95776c5ee1f1b37f361b35c3e8da9ed3
Instruction ID: 88e592a984b0579e2687da1369d8fe688cdec7a6dea7db10473ee1d8394db698
Opcode Fuzzy Hash: 4805e2b42d056b3b2d7b2bd722e5615b95776c5ee1f1b37f361b35c3e8da9ed3
Instruction Fuzzy Hash: 4E3161B1E002A99BDB25CF15CD407DEB6A4BB09755F0080AAE959E7280D7B4DFC4AAD0

Uniqueness

Uniqueness Score: -1.00%

Function 00C14650 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,00000000,00000000,?,?,?,00C137C6,?,?,?), ref: 00C14674
GetLastError.KERNEL32(?,?,00C137C6,?,?,?), ref: 00C1467E

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 00C146A7

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 442123175-1688708105
Opcode ID: 59cc2619f02f72aedb549fc359079bbf06503592081dabab89e305a1a065750e
Instruction ID: 2123544697603a45c6a2cdd7058e5e2ea0f4fc76440197736fea0bcc67372ed5
Opcode Fuzzy Hash: 59cc2619f02f72aedb549fc359079bbf06503592081dabab89e305a1a065750e
Instruction Fuzzy Hash: 31F06D33A01129FBD7108F9ACD45EDFBBA9BB46765F114121B904E6140E660AA4096E1

Uniqueness

Uniqueness Score: -1.00%

Function 00C1412E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,00BE8651,00000000,00000000,00000000,00000000,00000000), ref: 00C14146
GetLastError.KERNEL32(?,?,?,00BE8651,00000000,00000000,00000000,00000000,00000000), ref: 00C14150

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 00C14174

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 2976181284-1688708105
Opcode ID: f579213102a14b86ef548b2fdcdaeb1d05a8ee5d30c1cccd1d1fc7132b393b20
Instruction ID: 9497ad5704a0b416cfc537dd5f45ba1ba344ad2f8b2e9c2df8a52247d4021f34
Opcode Fuzzy Hash: f579213102a14b86ef548b2fdcdaeb1d05a8ee5d30c1cccd1d1fc7132b393b20
Instruction Fuzzy Hash: CFF08172A0012ABBDB248F85CD09EDF7FA9EF15760F018054FD05AB251E271DD90E6A0

Uniqueness

Uniqueness Score: -1.00%

Function 00BD38D1 Relevance: 4.6, APIs: 3, Instructions: 79libraryCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00BD3910
GetLastError.KERNEL32 ref: 00BD391A
LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 00BD3983

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: DirectoryErrorLastLibraryLoadSystem
String ID:
API String ID: 1230559179-0
Opcode ID: 3d24735d79aeff2ab47fe2bbdf46979ef0be0bcd5f6555ee92d2e1eff88ddb73
Instruction ID: 0e3316ead00e168b6e075ec7c4a2ff64ef59676f2096415cc204b1eee910011e
Opcode Fuzzy Hash: 3d24735d79aeff2ab47fe2bbdf46979ef0be0bcd5f6555ee92d2e1eff88ddb73
Instruction Fuzzy Hash: 47212BB6D0133967DB209B648C45F9EB3E89B00B14F1101E2BD05F7342F674DE448692

Uniqueness

Uniqueness Score: -1.00%

Function 00BD3AA4 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,00C0FB87,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,00C0FB1B,000001C7), ref: 00BD3AAE
RtlFreeHeap.NTDLL(00000000,?,00C0FB87,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,00C0FB1B,000001C7,?,?), ref: 00BD3AB5
GetLastError.KERNEL32(?,00C0FB87,00000000,8007139F,?,00000000,00000000,8007139F,?,?,?,00C0FB1B,000001C7,?,?), ref: 00BD3ABF

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Heap$ErrorFreeLastProcess
String ID:
API String ID: 406640338-0
Opcode ID: ef4c92a2aa09268abeabd672fcc36cecc994f8d0e2349361038ae2e05a347d39
Instruction ID: 3d9fbd1d351f2613e7eb756781d31d413d5b64d832c0d18d604a360b1b779716
Opcode Fuzzy Hash: ef4c92a2aa09268abeabd672fcc36cecc994f8d0e2349361038ae2e05a347d39
Instruction Fuzzy Hash: 8FD01273B0113AA7872117E56C0CB9FFED8FF06AA1B028161FD49E6211EA25CD0097E6

Uniqueness

Uniqueness Score: -1.00%

Function 00C10823 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00C3AA7C,00000000,?,00C14FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00C10837

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 00C10874

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Open
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 71445658-3237223240
Opcode ID: cffab5e371d5f9723ab82c832ce652da62b1b46bf68bf8b8916a380d0ec64807
Instruction ID: 730dbfab22cda7f42d1ddc8c60fc89bdffa17c7e6a2d55e613e073747231284d
Opcode Fuzzy Hash: cffab5e371d5f9723ab82c832ce652da62b1b46bf68bf8b8916a380d0ec64807
Instruction Fuzzy Hash: D2F05932B08121A3A73009968C05BEB7E859B42BB0F254035BD0CEB2E0E6A5CCD0A3E0

Uniqueness

Uniqueness Score: -1.00%

Function 00BD3B7C Relevance: 3.0, APIs: 2, Instructions: 14memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,?,00BD2375,000001C7,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000), ref: 00BD3B90
RtlReAllocateHeap.NTDLL(00000000,?,00BD2375,000001C7,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD3B97

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 79f1cfc8101bb49e5efd6ceb1849708a50c02720ebd0ee229a3097e97cd6ec95
Instruction ID: d62816dcd0a278fc9a322641396471768077f336a00651524405bb9c07514e55
Opcode Fuzzy Hash: 79f1cfc8101bb49e5efd6ceb1849708a50c02720ebd0ee229a3097e97cd6ec95
Instruction Fuzzy Hash: 7CD0C93219420DFB8F005FE8DC09EAE3BADFB59612B14C405B915C2120C63DE4209A61

Uniqueness

Uniqueness Score: -1.00%

Function 00BD39DF Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,000001C7,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F0
RtlAllocateHeap.NTDLL(00000000,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F7

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 727822d1b14c9a84061e22711021160df7528cb212178c8d93c570a52d4b707c
Instruction ID: e26b9b49272a0be395a6be8c5371942f145635e730807afbdbdb7e650f2e1787
Opcode Fuzzy Hash: 727822d1b14c9a84061e22711021160df7528cb212178c8d93c570a52d4b707c
Instruction Fuzzy Hash: 04C0123219420CFB8B005FF4DC0DE9E37ACB715612B14C400B505C2110C638E0108761

Uniqueness

Uniqueness Score: -1.00%

Function 00C12E25 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C12E5A

Part of subcall function 00C128BD: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,00C12E6B,00000000,?,00000000), ref: 00C128D7
Part of subcall function 00C128BD: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00BFBD14,?,00BD5442,?,00000000,?), ref: 00C128E3

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorHandleInitLastModuleVariant
String ID:
API String ID: 52713655-0
Opcode ID: 042535c4ce6879581e86cd7f20221420830e2417f63127ae96628c108fb2b99d
Instruction ID: 22e873db10cd0de8627aaf4923c4f8b98dea76761ee6b5d9d402eb9a6c45d221
Opcode Fuzzy Hash: 042535c4ce6879581e86cd7f20221420830e2417f63127ae96628c108fb2b99d
Instruction Fuzzy Hash: DA315C76E006299FCB11DFA8C884ADEF7F8EF09710F01456AE915FB311E6309D549BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C1506B Relevance: 1.6, APIs: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(80070490,00000000,80070490,00C3AA7C,00000000,80070490,?,?,00BE89F4,WiX\Burn,PackageCache,00000000,00C3AA7C,00000000,00000000,80070490), ref: 00C150C5

Part of subcall function 00C1095E: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00C109D4
Part of subcall function 00C1095E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00C10A0C

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: QueryValue$Close
String ID:
API String ID: 1979452859-0
Opcode ID: c117aeed515bcf55a3cc2b34ff351c796dc087687e9f5b8485af23eee581fab8
Instruction ID: 924d7003128b83f0928576c47f896081101d4a70dc97605d3e283c67dd255480
Opcode Fuzzy Hash: c117aeed515bcf55a3cc2b34ff351c796dc087687e9f5b8485af23eee581fab8
Instruction Fuzzy Hash: E2110636C0052AEBCB32AFD489855EEB664EB8A320B20407AFD5163210C3714ED0F7D2

Uniqueness

Uniqueness Score: -1.00%

Function 00C0855E Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00C071F5: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00C059DE,00000001,00000364), ref: 00C07236

_free.LIBCMT ref: 00C085CA

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 0732909711a50b9945796346256193ab87f046156481c215ee8d356fc10d6c03
Instruction ID: f5e8b955122ecd7f7521c1e47f361e5c91fc5b307d40da2aaddb7f18a06700f2
Opcode Fuzzy Hash: 0732909711a50b9945796346256193ab87f046156481c215ee8d356fc10d6c03
Instruction Fuzzy Hash: 1401D672604305ABE3218F69DC4195AFBE9FB89370F25061DE5D4932C0EA30A909CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00C071F5 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00C059DE,00000001,00000364), ref: 00C07236

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 354a0673adc8b62ec65aaf8a0a04c475423098d2a48163d1965be46c939a37c3
Instruction ID: 619ebe9a3ea1f473a84e734c82f45f1532f63f939e61a3ab65d027fe34a305bc
Opcode Fuzzy Hash: 354a0673adc8b62ec65aaf8a0a04c475423098d2a48163d1965be46c939a37c3
Instruction Fuzzy Hash: 57F0E971E0C225F6DB2D5A239C05B5F3788BF427B0B15A311BD24961D0CA30FD11C2E0

Uniqueness

Uniqueness Score: -1.00%

Function 00BD35A8 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,00BE8AAE,0000001C,80070490,00000000,00000000,80070490), ref: 00BD35C8

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 03a9134b8d305a96ebbc676d37a240b44afe4e722e73b10157f1b0ecda4b6092
Instruction ID: 5fea3a73ea2c3c1276803f5efe37728705e1747a21c11f28ab451d61b9080d58
Opcode Fuzzy Hash: 03a9134b8d305a96ebbc676d37a240b44afe4e722e73b10157f1b0ecda4b6092
Instruction Fuzzy Hash: 94E012723411247BAA016BA57C01EFBBBDCEF257A57048492FE44D6111EA61D61057B1

Uniqueness

Uniqueness Score: -1.00%

Function 00BD14AC Relevance: 1.3, APIs: 1, Instructions: 52stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,00000000,?,?,00BD22B1,?,00000000,?,00000000,?,00BD39A5,00000000,?,00000104), ref: 00BD14DC

Part of subcall function 00BD3C5F: GetProcessHeap.KERNEL32(00000000,000001C7,?,00BD22D5,000001C7,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD3C67
Part of subcall function 00BD3C5F: HeapSize.KERNEL32(00000000,?,00BD22D5,000001C7,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD3C6E

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: 8508b65f53cd07d47e0b7ce8b5e38e74ea2377390b13deeaf514d00d8c528c80
Instruction ID: 21dbfc661648537b234eee17276d7423d4d9ca2336f0caba4db1c3e0bea85904
Opcode Fuzzy Hash: 8508b65f53cd07d47e0b7ce8b5e38e74ea2377390b13deeaf514d00d8c528c80
Instruction Fuzzy Hash: 2A01B536100124BBCF116E59EC80FCAFBEAEF51760F108993FE156B391E671E9409AA0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00BD3D4E Relevance: 45.8, APIs: 23, Strings: 3, Instructions: 309fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,?,?,?,00000001,00000000,?), ref: 00BD3DAD
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00BD3DC0
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000001,00000000,?), ref: 00BD3E0C
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00BD3E16
GetTempPathW.KERNEL32(00000104,?,?,?,?,00000001,00000000,?), ref: 00BD3E5D
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00BD3E67
FindFirstFileW.KERNEL32(?,?,?,*.*,?,?,?,?,00000001,00000000,?), ref: 00BD3EB5
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00BD3EC6
SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00000001,00000000,?), ref: 00BD3F98
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,00000001,00000000,?), ref: 00BD3FAC
GetTempFileNameW.KERNEL32(?,DEL,00000000,?,?,?,?,00000001,00000000,?), ref: 00BD3FD5
MoveFileExW.KERNEL32(?,?,00000001,?,?,?,00000001,00000000,?), ref: 00BD3FF8
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 00BD4011
FindNextFileW.KERNEL32(000000FF,?,?,?,?,?,?,?,00000001,00000000,?), ref: 00BD4021
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00BD4036
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00BD4065
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00BD4087
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00BD40A9
RemoveDirectoryW.KERNEL32(?,?,?,?,00000001,00000000,?), ref: 00BD40B3
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00BD40BD
MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 00BD40E1
GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00BD40FC
FindClose.KERNEL32(000000FF,?,?,?,00000001,00000000,?), ref: 00BD4132

Strings

c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp, xrefs: 00BD3DE3, 00BD4056
DEL, xrefs: 00BD3FC9
*.*, xrefs: 00BD3E93

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorFileLast$AttributesFindMove$Temp$CloseDeleteDirectoryFirstNameNextPathRemove
String ID: *.*$DEL$c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp
API String ID: 1544372074-2145791747
Opcode ID: 368570a0145cd4a31def7ede6abe455550094fdd65fce668eba14d0c577eefa6
Instruction ID: b896d44ce830df213f1995091bfe756bad9fe5c4dbd2815de6c5974c37be6b82
Opcode Fuzzy Hash: 368570a0145cd4a31def7ede6abe455550094fdd65fce668eba14d0c577eefa6
Instruction Fuzzy Hash: A4A1F972D01239A7DB3196648C45BEEEAE9DF10B60F0542D3EE44B7291F7758D80CAE1

Uniqueness

Uniqueness Score: -1.00%

Function 00C10FA6 Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 336COMMON

Download Yara Rule

APIs

InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 00C1103E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C11048
CreateWellKnownSid.ADVAPI32(0000001A,00000000,?,?), ref: 00C11095
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C1109B
CreateWellKnownSid.ADVAPI32(00000017,00000000,?,?), ref: 00C110D5
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C110DB
CreateWellKnownSid.ADVAPI32(00000018,00000000,?,?), ref: 00C1111B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C11121
CreateWellKnownSid.ADVAPI32(00000010,00000000,?,?), ref: 00C11161
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C11167
CreateWellKnownSid.ADVAPI32(00000016,00000000,?,?), ref: 00C111A7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C111AD
SetEntriesInAclA.ADVAPI32(00000005,?,00000000,?), ref: 00C1129E
SetSecurityDescriptorOwner.ADVAPI32(?,?,00000000), ref: 00C112D8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C112E2
SetSecurityDescriptorGroup.ADVAPI32(?,?,00000000), ref: 00C1131A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C11324
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00C1135D
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C11367
CoInitializeSecurity.OLE32(?,000000FF,00000000,00000000,00000006,00000002,00000000,00003000,00000000), ref: 00C113A5
LocalFree.KERNEL32(?), ref: 00C113BB

Strings

c:\agent\_work\66\s\src\libs\dutil\srputil.cpp, xrefs: 00C11069

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$CreateKnownSecurityWell$Descriptor$Initialize$DaclEntriesFreeGroupLocalOwner
String ID: c:\agent\_work\66\s\src\libs\dutil\srputil.cpp
API String ID: 267631441-212431265
Opcode ID: dd08eb9bfeb26c072ac1497cea7a5d7ad7e9d832069a80da1940fda43984d814
Instruction ID: 0f8d87863a46fd0fc064cfe64131fa38afdbbde92dd56e11ea58a3df43c78b7d
Opcode Fuzzy Hash: dd08eb9bfeb26c072ac1497cea7a5d7ad7e9d832069a80da1940fda43984d814
Instruction Fuzzy Hash: 21C1A776C41239ABD7308F958C48BDEFABCBF45710F1141AAAE15F7250E6748E80DEA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BFC01F Relevance: 37.1, APIs: 1, Strings: 20, Instructions: 375COMMON

Download Yara Rule

Strings

Failed to copy local source path for pseudo bundle., xrefs: 00BFC127
Failed to copy filename for pseudo bundle., xrefs: 00BFC103
Failed to copy download source for pseudo bundle., xrefs: 00BFC155
Failed to allocate memory for dependency providers., xrefs: 00BFC3CA
Failed to append relation type to uninstall arguments for related bundle package, xrefs: 00BFC330
Failed to copy key for pseudo bundle payload., xrefs: 00BFC0DF
Failed to copy repair arguments for related bundle package, xrefs: 00BFC2BC
Failed to append relation type to repair arguments for related bundle package, xrefs: 00BFC2DD
Failed to copy display name for pseudo bundle., xrefs: 00BFC43B
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 00BFC0AA
c:\agent\_work\66\s\src\burn\engine\pseudobundle.cpp, xrefs: 00BFC065, 00BFC09E, 00BFC18D, 00BFC3BE
Failed to copy key for pseudo bundle., xrefs: 00BFC22C
Failed to allocate space for burn package payload inside of related bundle struct, xrefs: 00BFC071
Failed to copy version for pseudo bundle., xrefs: 00BFC419
Failed to copy uninstall arguments for related bundle package, xrefs: 00BFC30F
Failed to copy cache id for pseudo bundle., xrefs: 00BFC24B
Failed to allocate memory for pseudo bundle payload hash., xrefs: 00BFC199
Failed to append relation type to install arguments for related bundle package, xrefs: 00BFC294
Failed to copy install arguments for related bundle package, xrefs: 00BFC273
-%ls, xrefs: 00BFC03C

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: -%ls$Failed to allocate memory for dependency providers.$Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of related bundle struct$Failed to allocate space for burn payload inside of related bundle struct$Failed to append relation type to install arguments for related bundle package$Failed to append relation type to repair arguments for related bundle package$Failed to append relation type to uninstall arguments for related bundle package$Failed to copy cache id for pseudo bundle.$Failed to copy display name for pseudo bundle.$Failed to copy download source for pseudo bundle.$Failed to copy filename for pseudo bundle.$Failed to copy install arguments for related bundle package$Failed to copy key for pseudo bundle payload.$Failed to copy key for pseudo bundle.$Failed to copy local source path for pseudo bundle.$Failed to copy repair arguments for related bundle package$Failed to copy uninstall arguments for related bundle package$Failed to copy version for pseudo bundle.$c:\agent\_work\66\s\src\burn\engine\pseudobundle.cpp
API String ID: 1357844191-3959581252
Opcode ID: 3dc04bd1d519af5e9fc5a9844ef47a6c034a6a6b92ccaf1d0df740910da000b0
Instruction ID: 798852aae8c699382634c618c07b2cad9f94667da9b8fcc189df640cc8df116c
Opcode Fuzzy Hash: 3dc04bd1d519af5e9fc5a9844ef47a6c034a6a6b92ccaf1d0df740910da000b0
Instruction Fuzzy Hash: BFC1053164065EABDB258F38C992E7ABBE4FF04710B1081AAFE15E7341D770EC948B90

Uniqueness

Uniqueness Score: -1.00%

Function 00BD4639 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 140sleepshutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000020,?,00000001,00000000,?,?,?,?,?,?,?), ref: 00BD4662
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00BD4669
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00BD4673
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00BD46C3
GetLastError.KERNEL32 ref: 00BD46CD
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000001,00000010,00000000,00000000), ref: 00BD4711
GetLastError.KERNEL32 ref: 00BD471B
Sleep.KERNEL32(000003E8), ref: 00BD4757
InitiateSystemShutdownExW.ADVAPI32(00000000,00000000,00000000,00000000,00000001,80040002), ref: 00BD4768
GetLastError.KERNEL32 ref: 00BD4772
CloseHandle.KERNEL32(?), ref: 00BD47C8

Strings

Failed to adjust token to add shutdown privileges., xrefs: 00BD4749
Failed to get process token., xrefs: 00BD46A1
Failed to schedule restart., xrefs: 00BD47B3
SeShutdownPrivilege, xrefs: 00BD46B6
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 00BD4697, 00BD46F1, 00BD473F, 00BD47A9
Failed to get shutdown privilege LUID., xrefs: 00BD46FB

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$ProcessToken$AdjustCloseCurrentHandleInitiateLookupOpenPrivilegePrivilegesShutdownSleepSystemValue
String ID: Failed to adjust token to add shutdown privileges.$Failed to get process token.$Failed to get shutdown privilege LUID.$Failed to schedule restart.$SeShutdownPrivilege$c:\agent\_work\66\s\src\burn\engine\engine.cpp
API String ID: 2241679041-3136258258
Opcode ID: ac99487c6554e767cb270980241565fd3ad32a45b061e9e23de50b146963c52e
Instruction ID: 6a1b7b483f50a40b863fa2ebc0e2ac49640cb82733d69fcc4ab6a3841a3c29db
Opcode Fuzzy Hash: ac99487c6554e767cb270980241565fd3ad32a45b061e9e23de50b146963c52e
Instruction Fuzzy Hash: BD413C7694122577E7204BA44D49BEFB6D8FB06B51F1240A6FE02B7380F7788C4096D1

Uniqueness

Uniqueness Score: -1.00%

Function 00BE4E6A Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 164pipeCOMMON

Download Yara Rule

APIs

ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD),00000001,?,00000000), ref: 00BE4E98
GetLastError.KERNEL32(?,00000000,?,?,00BD457C,?), ref: 00BE4EA1
CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,?,?,00000000,?,?,00BD457C,?), ref: 00BE4F43
GetLastError.KERNEL32(?,00BD457C,?), ref: 00BE4F50
CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,00000000,?,?,?,?,?,?,?,00BD457C), ref: 00BE4FCB
GetLastError.KERNEL32(?,?,?,?,?,?,?,00BD457C,?), ref: 00BE4FD6
CloseHandle.KERNEL32(00000000,c:\agent\_work\66\s\src\burn\engine\pipe.cpp,00000132,00000000,?,?,?,?,?,?,?,00BD457C,?), ref: 00BE5016
LocalFree.KERNEL32(00000000,?,00BD457C,?), ref: 00BE5044

Strings

\\.\pipe\%ls, xrefs: 00BE4EF9
Failed to create pipe: %ls, xrefs: 00BE4F81, 00BE5007
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 00BE4EC5, 00BE4F74, 00BE4FFA
Failed to create the security descriptor for the connection event and pipe., xrefs: 00BE4ECF
\\.\pipe\%ls.Cache, xrefs: 00BE4F97
Failed to allocate full name of cache pipe: %ls, xrefs: 00BE4FAD
Failed to allocate full name of pipe: %ls, xrefs: 00BE4F0F
D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD), xrefs: 00BE4E93

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$CreateDescriptorNamedPipeSecurity$CloseConvertFreeHandleLocalString
String ID: D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD)$Failed to allocate full name of cache pipe: %ls$Failed to allocate full name of pipe: %ls$Failed to create pipe: %ls$Failed to create the security descriptor for the connection event and pipe.$\\.\pipe\%ls$\\.\pipe\%ls.Cache$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 1214480349-1710103387
Opcode ID: 79ddf86742694fef390ef109e11274051ed376c11621802b2d6c9ace208d86fc
Instruction ID: c3609289a7dd816cf6fe1cb80535fc5ee889ca36d3788390dc7440c1dd7b83cc
Opcode Fuzzy Hash: 79ddf86742694fef390ef109e11274051ed376c11621802b2d6c9ace208d86fc
Instruction Fuzzy Hash: 09510672D40265BBDB219B95DC46B9EBBE4FF04720F1141A1FD00B62D2E3B95E40DAD1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0F340 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 172encryptionfileCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000003,F0000040,00000003,00000000,00000000,00BE9DDA,00000003,000007D0,00000003,?,000007D0,?,000007D0), ref: 00C0F3A5
GetLastError.KERNEL32 ref: 00C0F3AF
CryptCreateHash.ADVAPI32(?,?,00000000,00000000,?), ref: 00C0F3EC
GetLastError.KERNEL32 ref: 00C0F3F6
CryptHashData.ADVAPI32(?,?,?,00000000), ref: 00C0F43D
ReadFile.KERNEL32(00000000,?,00001000,?,00000000), ref: 00C0F461
GetLastError.KERNEL32 ref: 00C0F46B
CryptDestroyHash.ADVAPI32(00000000), ref: 00C0F4A8
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 00C0F4BF
GetLastError.KERNEL32 ref: 00C0F4D8
CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000), ref: 00C0F510
GetLastError.KERNEL32 ref: 00C0F51A
SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00008004,00000001), ref: 00C0F553
GetLastError.KERNEL32 ref: 00C0F561

Strings

c:\agent\_work\66\s\src\libs\dutil\cryputil.cpp, xrefs: 00C0F48F

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CryptErrorLast$Hash$ContextFile$AcquireCreateDataDestroyParamPointerReadRelease
String ID: c:\agent\_work\66\s\src\libs\dutil\cryputil.cpp
API String ID: 3955742341-1443093764
Opcode ID: ee8ecf56a5dd1e3027abe149ff6db62b60575a0d5bea31d96a163e04138b1191
Instruction ID: 24090dbe685b224319a27189c6ea4ae74dc97cb21d8012eab68cc1d88477b41d
Opcode Fuzzy Hash: ee8ecf56a5dd1e3027abe149ff6db62b60575a0d5bea31d96a163e04138b1191
Instruction Fuzzy Hash: 2251F537D41239ABD7318A958D08BEF7AA4BB08751F0140B9BE49F65D0E2748EC1DAE1

Uniqueness

Uniqueness Score: -1.00%

Function 00BE9D74 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 180COMMON

Download Yara Rule

Strings

Failed to get cached path for package with cache id: %ls, xrefs: 00BE9D9E
Failed to create unverified path., xrefs: 00BE9E44
Failed to concat complete cached path., xrefs: 00BE9DCA
copying, xrefs: 00BE9F06, 00BE9F0E
Failed to transfer working path to unverified path for payload: %ls., xrefs: 00BE9E7A
Failed to move verified file to complete payload path: %ls, xrefs: 00BE9F42
moving, xrefs: 00BE9EFF
Failed to find payload: %ls in working path: %ls and unverified path: %ls, xrefs: 00BE9EA1
Failed to reset permissions on unverified cached payload: %ls, xrefs: 00BE9EC7

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID:
String ID: Failed to concat complete cached path.$Failed to create unverified path.$Failed to find payload: %ls in working path: %ls and unverified path: %ls$Failed to get cached path for package with cache id: %ls$Failed to move verified file to complete payload path: %ls$Failed to reset permissions on unverified cached payload: %ls$Failed to transfer working path to unverified path for payload: %ls.$copying$moving
API String ID: 0-1289240508
Opcode ID: 1187efdf27f84c25e7fd7f6686ef64afef29a91f7ff847c5da70740f9cdb841f
Instruction ID: 585232afbcd311f8e65790760b1dc6cc33754ae16abdae645d5c3ab77ea5b385
Opcode Fuzzy Hash: 1187efdf27f84c25e7fd7f6686ef64afef29a91f7ff847c5da70740f9cdb841f
Instruction Fuzzy Hash: F7518131D00665BBDF226B91DD42F9EBBB6AF14700F1041A1FA00B51A1E7729E65FB81

Uniqueness

Uniqueness Score: -1.00%

Function 00BD62CC Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 143COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C), ref: 00BD631A
GetLastError.KERNEL32 ref: 00BD6324

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00BD6348
Failed to set variant value., xrefs: 00BD6445
Failed to get OS info., xrefs: 00BD6352

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLastVersion
String ID: Failed to get OS info.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 305913169-1157376746
Opcode ID: b88c44169643398a839c1a26d08931ac50296733ce146083ad343668e50d8a1c
Instruction ID: d350d385ee2bb9c11dae646861149c3886d0b0fa4867dc7cbc34448436130236
Opcode Fuzzy Hash: b88c44169643398a839c1a26d08931ac50296733ce146083ad343668e50d8a1c
Instruction Fuzzy Hash: 3F418171A01228ABDB20DB599C45FEFBBF8EB45720F10459BF545E7240E634AA81CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00BD605F Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 106timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00BD608A
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,00000000,00000000), ref: 00BD609E
GetLastError.KERNEL32 ref: 00BD60B0
GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,00000000,?,00000000), ref: 00BD6104
GetLastError.KERNEL32 ref: 00BD610E

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00BD60CB, 00BD6129
Failed to allocate the buffer for the Date., xrefs: 00BD60EC
Failed to set variant value., xrefs: 00BD614C
Failed to get the Date., xrefs: 00BD6133
Failed to get the required buffer length for the Date., xrefs: 00BD60D5

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: DateErrorFormatLast$SystemTime
String ID: Failed to allocate the buffer for the Date.$Failed to get the Date.$Failed to get the required buffer length for the Date.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 2700948981-3414009094
Opcode ID: 7b1b561d785ef76c4dd1ed31a1b98c35b745dafc67c2cd2e07f465f7b3c35a59
Instruction ID: 552e6f72ac57fd0332e9db6ed2910574afac513bafadb54706b2994a310dded2
Opcode Fuzzy Hash: 7b1b561d785ef76c4dd1ed31a1b98c35b745dafc67c2cd2e07f465f7b3c35a59
Instruction Fuzzy Hash: D531B932A402297BDB1296E49C82FEFFBF8AB05750F114066FB01F7381EA609D4496D1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0F79E Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 131threadtimeCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00C3B5D4,00000000,?,?,?,?,00BF1074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 00C0F7CC
GetCurrentProcessId.KERNEL32(00000000,?,00BF1074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 00C0F7DC
GetCurrentThreadId.KERNEL32 ref: 00C0F7E5
GetLocalTime.KERNEL32(8007139F,?,00BF1074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 00C0F7FB
LeaveCriticalSection.KERNEL32(00C3B5D4,00BF1074,?,00000000,0000FDE9,?,00BF1074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 00C0F8F2

Strings

%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls, xrefs: 00C0F898

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
String ID: %ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls
API String ID: 296830338-59366893
Opcode ID: 9d7bc89e26e8a7831f4f19811ce82fafe788af64f4bc3ad0e75e9ffbb7f2901f
Instruction ID: c5ef3f2ccb67425b9695529a76b01d77193172cd897f3d635e939ba900b386d1
Opcode Fuzzy Hash: 9d7bc89e26e8a7831f4f19811ce82fafe788af64f4bc3ad0e75e9ffbb7f2901f
Instruction Fuzzy Hash: 7341A272D01119ABCF218FA5C804BFEB7B8AB09715F108139F911A62E0D7349E82DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BE9A1D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 107filestringCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,00000000,?,*.*,?,?,?,00000000,.unverified,?), ref: 00BE9ACC
lstrlenW.KERNEL32(?), ref: 00BE9AF3
FindNextFileW.KERNEL32(00000000,00000010), ref: 00BE9B53
FindClose.KERNEL32(00000000), ref: 00BE9B5E

Part of subcall function 00BD3D4E: GetFileAttributesW.KERNEL32(?,?,?,?,00000001,00000000,?), ref: 00BD3DAD
Part of subcall function 00BD3D4E: GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 00BD3DC0

Strings

.unverified, xrefs: 00BE9A60
*.*, xrefs: 00BE9AA6

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: FileFind$AttributesCloseErrorFirstLastNextlstrlen
String ID: *.*$.unverified
API String ID: 457978746-2528915496
Opcode ID: ae80c1eb65218825756022542a7a53947aec4fa8b0ac76a81d119e683607d1d5
Instruction ID: 745d91ebd07990a0455c22fdd720f916e6e2ec2a1e2b3b8781e2791769edef7a
Opcode Fuzzy Hash: ae80c1eb65218825756022542a7a53947aec4fa8b0ac76a81d119e683607d1d5
Instruction Fuzzy Hash: C6416F319006ACAEDB61AB65ED49BEEB7F8EF44701F1041E1E508E10A1EB709ED8DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00C18039 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 76timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000001,00000000), ref: 00C1808E
SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 00C180A0

Strings

%04hu-%02hu-%02huT%02hu:%02hu:%02huZ, xrefs: 00C18077
%04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u, xrefs: 00C180EB
crypt32.dll, xrefs: 00C1805E
feclient.dll, xrefs: 00C18068

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Time$InformationLocalSpecificSystemZone
String ID: %04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u$%04hu-%02hu-%02huT%02hu:%02hu:%02huZ$crypt32.dll$feclient.dll
API String ID: 1772835396-1985132828
Opcode ID: 2c0485d00158eec8c1aa720280ba28bb386b54d093b63a5c81761610de9dc809
Instruction ID: f9392fa45e8f4b1fa39be653f32d50a048442599b3bec9c48e8d2108c08d3313
Opcode Fuzzy Hash: 2c0485d00158eec8c1aa720280ba28bb386b54d093b63a5c81761610de9dc809
Instruction Fuzzy Hash: 592109A6900128BADB20DBA98C05FBFB3FCAB5D711F008456B945E2180E638AA84D771

Uniqueness

Uniqueness Score: -1.00%

Function 00BD6203 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 00BD6233
GetLastError.KERNEL32 ref: 00BD623D

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00BD625C
Failed to set variant value., xrefs: 00BD6282
Failed to get the user name., xrefs: 00BD6266

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLastNameUser
String ID: Failed to get the user name.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 2054405381-2744047247
Opcode ID: f99993375c95e601193b8488090621400f616a5945aca650ecf0ccae986bbb23
Instruction ID: 7fae00c4600feb5ea8b09a3cc5ccb03c8b5cb15056455f442fc9bf5ff418ba7d
Opcode Fuzzy Hash: f99993375c95e601193b8488090621400f616a5945aca650ecf0ccae986bbb23
Instruction Fuzzy Hash: 96014932A0023867C721EB659C45FEFB7E8AB01710F1002A6F801E3381EA24DD489B91

Uniqueness

Uniqueness Score: -1.00%

Function 00BD2078 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00BD42CC,00BD54CB,?,00000000,00000000,00000000,?,80070656,?,?,?,00BEE5B6,00000000,00BD54CB,00000000,80070656), ref: 00BD20A9
GetLastError.KERNEL32(?,?,?,00BEE5B6,00000000,00BD54CB,00000000,80070656,?,?,00BE4042,00BD54CB,?,80070656,00000001,crypt32.dll), ref: 00BD20B6
LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,?,00BEE5B6,00000000,00BD54CB,00000000,80070656,?,?,00BE4042,00BD54CB), ref: 00BD20FD

Strings

c:\agent\_work\66\s\src\libs\dutil\strutil.cpp, xrefs: 00BD20DA

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: c:\agent\_work\66\s\src\libs\dutil\strutil.cpp
API String ID: 1365068426-792799584
Opcode ID: 07abe8e67449c9d541c4d7c7576c53993bb69969fcc3a0a1c58355def3bbe0f4
Instruction ID: 2c85ab61558a13c5a5c454a45235282e4122eaed660b40de29a38aefcdfc20ac
Opcode Fuzzy Hash: 07abe8e67449c9d541c4d7c7576c53993bb69969fcc3a0a1c58355def3bbe0f4
Instruction Fuzzy Hash: 870161B6841129FBDB109B94DD05ADEBAECEB09750F0181A2BD01F7240F6358E40D7E1

Uniqueness

Uniqueness Score: -1.00%

Function 00BF68EE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000003,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00BF689A,00000000,00000003), ref: 00BF6905
GetLastError.KERNEL32(?,00BF689A,00000000,00000003,00000000,?,?,?,?,?,?,?,?,?,00BF6C89,?), ref: 00BF690F

Strings

Failed to set service start type., xrefs: 00BF693D
c:\agent\_work\66\s\src\burn\engine\msuengine.cpp, xrefs: 00BF6933

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ChangeConfigErrorLastService
String ID: Failed to set service start type.$c:\agent\_work\66\s\src\burn\engine\msuengine.cpp
API String ID: 1456623077-3535627199
Opcode ID: d6ce37cdac64a033c80d1f009de44265a404c8134b2c3c68d663e765c198e44e
Instruction ID: 19f87ea0a2573c5a4eff054b740a049a70d58500b1b5145835b193de9b967fbb
Opcode Fuzzy Hash: d6ce37cdac64a033c80d1f009de44265a404c8134b2c3c68d663e765c198e44e
Instruction Fuzzy Hash: 0EF0EC3764513937862016957D05F9F7E88EF06B707128365FF28B76D1E5658C0092E5

Uniqueness

Uniqueness Score: -1.00%

Function 00C034A2 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 00C0359A
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 00C035A4
UnhandledExceptionFilter.KERNEL32(80003CDD,?,?,?,?,?,?), ref: 00C035B1

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: e50a2c0b243db35ff2d3d0fc7ed9f8e98f3187fb7019b92ba6abbf9753d5ea8c
Instruction ID: 221177e370f3247ffba366fc3fb350e4792703edd2c1194682af02919a0277aa
Opcode Fuzzy Hash: e50a2c0b243db35ff2d3d0fc7ed9f8e98f3187fb7019b92ba6abbf9753d5ea8c
Instruction Fuzzy Hash: 8731A17591121CABCB21DF69D98979CBBB8BF08310F5041EAE51CA72A1EB309B85CF45

Uniqueness

Uniqueness Score: -1.00%

Function 00C04104 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,?,00C040DA,00000000,00C37908,0000000C,00C04231,00000000,00000002,00000000), ref: 00C04125
TerminateProcess.KERNEL32(00000000,?,00C040DA,00000000,00C37908,0000000C,00C04231,00000000,00000002,00000000), ref: 00C0412C
ExitProcess.KERNEL32 ref: 00C0413E

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 58e700064045282878b9d6eaa573e33132d5487f178dd176614ad510a05919da
Instruction ID: 9e03873c40d6ea6948bca3432cb6a0a36165a89e7c3bf1a8cf87952b565c7a95
Opcode Fuzzy Hash: 58e700064045282878b9d6eaa573e33132d5487f178dd176614ad510a05919da
Instruction Fuzzy Hash: 40E04671001208AFCF056F50DD08B9D3B2AFB11342F408014FA058B172CB39DD82DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00C132B9 Relevance: 3.1, APIs: 2, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C13448: RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,00C132E8,?), ref: 00C134B9

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00C1330C
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00C1331D

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AllocateCheckCloseInitializeMembershipToken
String ID:
API String ID: 2114926846-0
Opcode ID: ff722cbcf819cee6add116323f08830914a3b1faa0ae9431189e9f5f6edc2786
Instruction ID: 50e05f9a0602f88aaa911da5bc939863f0a711639e032bb3eff3637072201ec5
Opcode Fuzzy Hash: ff722cbcf819cee6add116323f08830914a3b1faa0ae9431189e9f5f6edc2786
Instruction Fuzzy Hash: 30118B7090024AEBDB10DFA5CC85BEEBBF8FF09348F90442AA111E6151D7709B84DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00C13C72 Relevance: 3.0, APIs: 2, Instructions: 43fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00BF8F6B,?,00000100,00000000,00000000), ref: 00C13CAD
FindClose.KERNEL32(00000000), ref: 00C13CB9

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 5403dce67498060b64255027942ad82d71f8e7b5033eebb18c3fd5220e21a9c9
Instruction ID: 0e489aa995f1099d22cb8cacb900977db873c66f825431401cd4e923b0f4a942
Opcode Fuzzy Hash: 5403dce67498060b64255027942ad82d71f8e7b5033eebb18c3fd5220e21a9c9
Instruction Fuzzy Hash: F201D671600218ABDB10EF699D89AEEB3ADEBC6329F100165F519D3280D6349E4D8790

Uniqueness

Uniqueness Score: -1.00%

Function 00BDFF35 Relevance: 86.2, APIs: 1, Strings: 48, Instructions: 482registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000101,?,?,00020006,00000000), ref: 00BE052B

Strings

"%ls" /modify, xrefs: 00BE0349
Comments, xrefs: 00BE02D3, 00BE02E6
VersionMinor, xrefs: 00BE00D1, 00BE00D7
BundleTag, xrefs: 00BE0114, 00BE0119
DisplayVersion, xrefs: 00BE019A, 00BE01AD
QuietUninstallString, xrefs: 00BE03E6, 00BE03FC
Failed to write update registration., xrefs: 00BE047E
HelpLink, xrefs: 00BE01F3, 00BE0206
"%ls" %ls, xrefs: 00BE041D
HelpTelephone, xrefs: 00BE0219, 00BE022C
%hs, xrefs: 00BE0131
ModifyPath, xrefs: 00BE034E, 00BE0364
3.11.2.4516, xrefs: 00BE012C
URLUpdateInfo, xrefs: 00BE0265, 00BE0278
Failed to write software tags., xrefs: 00BE045E
BundleAddonCode, xrefs: 00BE0011, 00BE0019
crypt32.dll, xrefs: 00BE017A, 00BE01BB, 00BE0452, 00BE0471
ParentKeyName, xrefs: 00BE02AB, 00BE02BE
"%ls" /uninstall /quiet, xrefs: 00BE03E1
Failed to create registration key., xrefs: 00BDFFB8
Publisher, xrefs: 00BE01CD, 00BE01E0
NoModify, xrefs: 00BE0324, 00BE0337
BundlePatchCode, xrefs: 00BE004D, 00BE0055
Failed to update name and publisher., xrefs: 00BE0187
BundleVersion, xrefs: 00BE006B, 00BE008E
/modify, xrefs: 00BE040D
URLInfoAbout, xrefs: 00BE023F, 00BE0252
Failed to cache bundle from path: %ls, xrefs: 00BDFF8B
Contact, xrefs: 00BE02FB, 00BE030E
%hu.%hu.%hu.%hu, xrefs: 00BE0089
BundleProviderKey, xrefs: 00BE00F3, 00BE00F8
ParentDisplayName, xrefs: 00BE028B, 00BE029E
NoElevateOnModify, xrefs: 00BE0370, 00BE0383
NoRemove, xrefs: 00BE039C, 00BE03AF
BundleUpgradeCode, xrefs: 00BDFFF3, 00BDFFFB
UninstallString, xrefs: 00BE0422, 00BE0438
EstimatedSize, xrefs: 00BE04B5, 00BE04BA, 00BE04C9
/uninstall, xrefs: 00BE0414, 00BE0419
Failed to write %ls value., xrefs: 00BE04CA
Failed to register the bundle dependency key., xrefs: 00BE04EC
%s,0, xrefs: 00BE0159
Failed to update resume mode., xrefs: 00BE0506
DisplayIcon, xrefs: 00BE0154, 00BE015E
BundleDetectCode, xrefs: 00BE002F, 00BE0037
SystemComponent, xrefs: 00BE03C1, 00BE03D4
EngineVersion, xrefs: 00BE0136, 00BE013B
VersionMajor, xrefs: 00BE00A8, 00BE00AE
BundleCachePath, xrefs: 00BDFFD8, 00BDFFDD

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Close
String ID: /uninstall$"%ls" %ls$"%ls" /modify$"%ls" /uninstall /quiet$%hs$%hu.%hu.%hu.%hu$%s,0$/modify$3.11.2.4516$BundleAddonCode$BundleCachePath$BundleDetectCode$BundlePatchCode$BundleProviderKey$BundleTag$BundleUpgradeCode$BundleVersion$Comments$Contact$DisplayIcon$DisplayVersion$EngineVersion$EstimatedSize$Failed to cache bundle from path: %ls$Failed to create registration key.$Failed to register the bundle dependency key.$Failed to update name and publisher.$Failed to update resume mode.$Failed to write %ls value.$Failed to write software tags.$Failed to write update registration.$HelpLink$HelpTelephone$ModifyPath$NoElevateOnModify$NoModify$NoRemove$ParentDisplayName$ParentKeyName$Publisher$QuietUninstallString$SystemComponent$URLInfoAbout$URLUpdateInfo$UninstallString$VersionMajor$VersionMinor$crypt32.dll
API String ID: 3535843008-3218910351
Opcode ID: 8f5b9c736b9757705c3b7668bfe19a2f23da06f6e8f0db9f147952ee40595568
Instruction ID: 503d814aa30bb25e1dfe2e27d5a6032d1cf87161d0af4c1f6cfac1e16a3e4d4c
Opcode Fuzzy Hash: 8f5b9c736b9757705c3b7668bfe19a2f23da06f6e8f0db9f147952ee40595568
Instruction Fuzzy Hash: F3F1C231951A66FBEF227651AD42BAD7AF1BF10710F2041A2F90076692C7F0EDE0B6D0

Uniqueness

Uniqueness Score: -1.00%

Function 00BDCD76 Relevance: 73.9, APIs: 3, Strings: 39, Instructions: 365COMMON

Download Yara Rule

APIs

Part of subcall function 00BD39DF: GetProcessHeap.KERNEL32(?,000001C7,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F0
Part of subcall function 00BD39DF: RtlAllocateHeap.NTDLL(00000000,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F7

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,download,000000FF,00000000,Packaging,00000000,00000000,FilePath,00BD549A,00000000,00C1BB64,00BD5482,00000000), ref: 00BDCEAC

Strings

c:\agent\_work\66\s\src\burn\engine\payload.cpp, xrefs: 00BDCDF8
CertificateRootPublicKeyIdentifier, xrefs: 00BDCFF6
Hash, xrefs: 00BDD070
Failed to get @CertificateRootPublicKeyIdentifier., xrefs: 00BDD170
Catalog, xrefs: 00BDD0A5
Packaging, xrefs: 00BDCE7F
external, xrefs: 00BDCEDA
Failed to hex decode @CertificateRootThumbprint., xrefs: 00BDD177
Failed to hex decode the Payload/@Hash., xrefs: 00BDD193
Invalid value for @Packaging: %ls, xrefs: 00BDD1B7
Failed to get @FilePath., xrefs: 00BDD1D1
Failed to get @Catalog., xrefs: 00BDD18C
Failed to get @LayoutOnly., xrefs: 00BDD14E
CertificateRootThumbprint, xrefs: 00BDD033
embedded, xrefs: 00BDCEBE
Failed to get @DownloadUrl., xrefs: 00BDD1A1
Failed to get @CertificateRootThumbprint., xrefs: 00BDD17E
Failed to parse @FileSize., xrefs: 00BDD158
Failed to get next node., xrefs: 00BDD1DF
Failed to select payload nodes., xrefs: 00BDCDA4
LayoutOnly, xrefs: 00BDCF46
Failed to allocate memory for payload structs., xrefs: 00BDCE02
Failed to get @Container., xrefs: 00BDD144
Failed to get @SourcePath., xrefs: 00BDD1A8
Failed to find catalog., xrefs: 00BDD185
SourcePath, xrefs: 00BDCF69
Payload, xrefs: 00BDCD91
Failed to get @Hash., xrefs: 00BDD19A
Failed to hex decode @CertificateRootPublicKeyIdentifier., xrefs: 00BDD169
Failed to get payload node count., xrefs: 00BDCDC9
Failed to get @FileSize., xrefs: 00BDD162
download, xrefs: 00BDCE9E
FileSize, xrefs: 00BDCFBB
Failed to get @Id., xrefs: 00BDD1D8
DownloadUrl, xrefs: 00BDCF92
FilePath, xrefs: 00BDCE64
Failed to to find container: %ls, xrefs: 00BDD13D
Failed to get @Packaging., xrefs: 00BDD1CA
Container, xrefs: 00BDCF04

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Heap$AllocateCompareProcessString
String ID: Catalog$CertificateRootPublicKeyIdentifier$CertificateRootThumbprint$Container$DownloadUrl$Failed to allocate memory for payload structs.$Failed to find catalog.$Failed to get @Catalog.$Failed to get @CertificateRootPublicKeyIdentifier.$Failed to get @CertificateRootThumbprint.$Failed to get @Container.$Failed to get @DownloadUrl.$Failed to get @FilePath.$Failed to get @FileSize.$Failed to get @Hash.$Failed to get @Id.$Failed to get @LayoutOnly.$Failed to get @Packaging.$Failed to get @SourcePath.$Failed to get next node.$Failed to get payload node count.$Failed to hex decode @CertificateRootPublicKeyIdentifier.$Failed to hex decode @CertificateRootThumbprint.$Failed to hex decode the Payload/@Hash.$Failed to parse @FileSize.$Failed to select payload nodes.$Failed to to find container: %ls$FilePath$FileSize$Hash$Invalid value for @Packaging: %ls$LayoutOnly$Packaging$Payload$SourcePath$c:\agent\_work\66\s\src\burn\engine\payload.cpp$download$embedded$external
API String ID: 1171520630-705547078
Opcode ID: bd6b80ec0cbce9357cccfd508d7b8cefab32715be86c920f7cc6d6b49c64d36a
Instruction ID: 0a240dd63a469b15a5db6640bf8ad05a0c11810b82969e3d4216af274926ed59
Opcode Fuzzy Hash: bd6b80ec0cbce9357cccfd508d7b8cefab32715be86c920f7cc6d6b49c64d36a
Instruction Fuzzy Hash: 8DC1827194522AFBDB119A90CC41EEDFAE5EF02710F1042B7FD51BB290E770AE91E690

Uniqueness

Uniqueness Score: -1.00%

Function 00BD8463 Relevance: 59.8, APIs: 5, Strings: 29, Instructions: 331COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00BD5482,?,00000000,80070490,?,?,?,?,?,?,?,?,00BFBEAE,?,00BD5482,?), ref: 00BD8494
LeaveCriticalSection.KERNEL32(00BD5482,?,?,?,?,?,?,?,?,00BFBEAE,?,00BD5482,?,00BD5482,00BD5482,Chain), ref: 00BD87F7

Strings

Failed to select variable nodes., xrefs: 00BD84B1
Failed to set variant value., xrefs: 00BD8778
Failed to get @Type., xrefs: 00BD8771
string, xrefs: 00BD85E4
Attempt to set built-in variable value: %ls, xrefs: 00BD87BB
Failed to find variable value '%ls'., xrefs: 00BD87C5
Failed to set variant encryption, xrefs: 00BD8790
Initializing string variable '%ls' to value '%ls', xrefs: 00BD8607
Failed to get @Value., xrefs: 00BD877F
Initializing numeric variable '%ls' to value '%ls', xrefs: 00BD85CF
Failed to get next node., xrefs: 00BD87E9
Initializing hidden variable '%ls', xrefs: 00BD865E
numeric, xrefs: 00BD85A9
Type, xrefs: 00BD8590
Failed to change variant type., xrefs: 00BD87CD
Failed to get @Persisted., xrefs: 00BD87D4
Failed to insert variable '%ls'., xrefs: 00BD8789
Variable, xrefs: 00BD849E
Hidden, xrefs: 00BD851C
Initializing version variable '%ls' to value '%ls', xrefs: 00BD8640
Failed to get variable node count., xrefs: 00BD84CE
Failed to set value of variable: %ls, xrefs: 00BD879A
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00BD87AC
Persisted, xrefs: 00BD8537
Failed to get @Id., xrefs: 00BD87E2
Invalid value for @Type: %ls, xrefs: 00BD875E
version, xrefs: 00BD8619
Failed to get @Hidden., xrefs: 00BD87DB
Value, xrefs: 00BD8552

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Attempt to set built-in variable value: %ls$Failed to change variant type.$Failed to find variable value '%ls'.$Failed to get @Hidden.$Failed to get @Id.$Failed to get @Persisted.$Failed to get @Type.$Failed to get @Value.$Failed to get next node.$Failed to get variable node count.$Failed to insert variable '%ls'.$Failed to select variable nodes.$Failed to set value of variable: %ls$Failed to set variant encryption$Failed to set variant value.$Hidden$Initializing hidden variable '%ls'$Initializing numeric variable '%ls' to value '%ls'$Initializing string variable '%ls' to value '%ls'$Initializing version variable '%ls' to value '%ls'$Invalid value for @Type: %ls$Persisted$Type$Value$Variable$c:\agent\_work\66\s\src\burn\engine\variable.cpp$numeric$string$version
API String ID: 3168844106-1329848934
Opcode ID: 5270fbd344b3a7fce8e764d151364013423dacde9a069ab20e4e0a867b2e4918
Instruction ID: f2a01d97492712ee9bc8b2a36533dfd82e016118e8e06751218471e2665a718d
Opcode Fuzzy Hash: 5270fbd344b3a7fce8e764d151364013423dacde9a069ab20e4e0a867b2e4918
Instruction Fuzzy Hash: 7BB1A372D00219FBCF11AB94DC45EEEFBB5AF45711F2041A6F910B6291EB319E40EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BF6A2D Relevance: 58.1, APIs: 7, Strings: 26, Instructions: 378COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,00BEBC99,00000007,?,?,?), ref: 00BF6A81

Part of subcall function 00C1038A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00BD5EE0,00000000), ref: 00C1039E
Part of subcall function 00C1038A: GetProcAddress.KERNEL32(00000000), ref: 00C103A5
Part of subcall function 00C1038A: GetLastError.KERNEL32(?,?,?,00BD5EE0,00000000), ref: 00C103BC

CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 00BF6E70
CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 00BF6E84

Strings

Failed to get cached path for package: %ls, xrefs: 00BF6B5D
WixBundleExecutePackageCacheFolder, xrefs: 00BF6B6C, 00BF6E9C
Failed to allocate WUSA.exe path., xrefs: 00BF6B14
Failed to append SysNative directory., xrefs: 00BF6ADE
Failed to get action arguments for MSU package., xrefs: 00BF6B37
D, xrefs: 00BF6C9C
Failed to ensure WU service was enabled to install MSU package., xrefs: 00BF6C8F
Failed to determine WOW64 status., xrefs: 00BF6A93
c:\agent\_work\66\s\src\burn\engine\msuengine.cpp, xrefs: 00BF6CEE, 00BF6D83, 00BF6DAB
Failed to find System32 directory., xrefs: 00BF6AF6
Failed to CreateProcess on path: %ls, xrefs: 00BF6CFB
Failed to build MSU path., xrefs: 00BF6B96
"%ls" "%ls" /quiet /norestart, xrefs: 00BF6BA9
Failed to format MSU uninstall command., xrefs: 00BF6BEA
Failed to get process exit code., xrefs: 00BF6D8D
"%ls" /uninstall /kb:%ls /quiet /norestart, xrefs: 00BF6BD6
2, xrefs: 00BF6D14
Failed to append log switch to MSU command-line., xrefs: 00BF6C17
Failed to find Windows directory., xrefs: 00BF6AC0
Failed to wait for executable to complete: %ls, xrefs: 00BF6DFF
SysNative\, xrefs: 00BF6ACB
Failed to append log path to MSU command-line., xrefs: 00BF6C35
Failed to format MSU install command., xrefs: 00BF6BBD
wusa.exe, xrefs: 00BF6B01
/log:, xrefs: 00BF6C03
Bootstrapper application aborted during MSU progress., xrefs: 00BF6DB5

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Handle$Close$AddressCurrentErrorLastModuleProcProcess
String ID: /log:$"%ls" "%ls" /quiet /norestart$"%ls" /uninstall /kb:%ls /quiet /norestart$2$Bootstrapper application aborted during MSU progress.$D$Failed to CreateProcess on path: %ls$Failed to allocate WUSA.exe path.$Failed to append SysNative directory.$Failed to append log path to MSU command-line.$Failed to append log switch to MSU command-line.$Failed to build MSU path.$Failed to determine WOW64 status.$Failed to ensure WU service was enabled to install MSU package.$Failed to find System32 directory.$Failed to find Windows directory.$Failed to format MSU install command.$Failed to format MSU uninstall command.$Failed to get action arguments for MSU package.$Failed to get cached path for package: %ls$Failed to get process exit code.$Failed to wait for executable to complete: %ls$SysNative\$WixBundleExecutePackageCacheFolder$c:\agent\_work\66\s\src\burn\engine\msuengine.cpp$wusa.exe
API String ID: 1400713077-2603125353
Opcode ID: d2bd99936267d6c8908cc9cf29e27079b8f5b564b71d91557ba8e66045df2dd7
Instruction ID: 7518f41e86ecc1ff1ce1c58070240980841eb7ea18b736c7679ba13ed531c3a2
Opcode Fuzzy Hash: d2bd99936267d6c8908cc9cf29e27079b8f5b564b71d91557ba8e66045df2dd7
Instruction Fuzzy Hash: F2D17D71A0031EABDB119FA4DD86ABEBBF8EF18700F1044B5FB00B7161D7B599489B51

Uniqueness

Uniqueness Score: -1.00%

Function 00C16C19 Relevance: 47.6, APIs: 13, Strings: 14, Instructions: 339COMMON

Download Yara Rule

APIs

Part of subcall function 00BD39DF: GetProcessHeap.KERNEL32(?,000001C7,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F0
Part of subcall function 00BD39DF: RtlAllocateHeap.NTDLL(00000000,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F7

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,generator,000000FF,?,?,?), ref: 00C16D2C
SysFreeString.OLEAUT32(00000000), ref: 00C16EF5
SysFreeString.OLEAUT32(00000000), ref: 00C16F92

Strings

icon, xrefs: 00C16D43
title, xrefs: 00C16DB7
generator, xrefs: 00C16D1F
link, xrefs: 00C16CC1, 00C16EA3
logo, xrefs: 00C16D7F
subtitle, xrefs: 00C16D9B
updated, xrefs: 00C16DD3
entry, xrefs: 00C16CA4, 00C16E6D
`<u, xrefs: 00C16EF5, 00C16F92
category, xrefs: 00C16C87, 00C16E34
author, xrefs: 00C16C6A, 00C16DFB
@, xrefs: 00C16E9B
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 00C16C46, 00C16F7C
(, xrefs: 00C16ED0

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: String$FreeHeap$AllocateCompareProcess
String ID: ($@$`<u$author$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp$category$entry$generator$icon$link$logo$subtitle$title$updated
API String ID: 1555028553-2833164091
Opcode ID: 253ebc93f1e63debf478b777499b326ce0ec4df49583cf9364f1dd5f8c68faf0
Instruction ID: cca591297c7ceba724d099715a62b4d5ffcc74e737cc743ce1b523993a6c9d9e
Opcode Fuzzy Hash: 253ebc93f1e63debf478b777499b326ce0ec4df49583cf9364f1dd5f8c68faf0
Instruction Fuzzy Hash: 0CB18235A44216BBCB11DBA4DC41FEEB678AF06720F204355F531AA2D1DB70EE91EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C168DE Relevance: 47.5, APIs: 11, Strings: 16, Instructions: 297COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,00C36470,000000FF,?,?,?), ref: 00C169A5
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,summary,000000FF), ref: 00C169CA
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 00C169EA
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,published,000000FF), ref: 00C16A06
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,updated,000000FF), ref: 00C16A2E
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,author,000000FF), ref: 00C16A4A
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,category,000000FF), ref: 00C16A83
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,content,000000FF), ref: 00C16ABC

Part of subcall function 00C16527: SysFreeString.OLEAUT32(00000000), ref: 00C16660
Part of subcall function 00C16527: SysFreeString.OLEAUT32(00000000), ref: 00C1669F

SysFreeString.OLEAUT32(00000000), ref: 00C16B40
SysFreeString.OLEAUT32(00000000), ref: 00C16BF0

Strings

msi.dll, xrefs: 00C16908
title, xrefs: 00C169DC
clbcatq.dll, xrefs: 00C16A13
link, xrefs: 00C16943, 00C16AEE
updated, xrefs: 00C16A20
cabinet.dll, xrefs: 00C16921
(, xrefs: 00C16B1B
version.dll, xrefs: 00C16904
`<u, xrefs: 00C16B40, 00C16BF0
category, xrefs: 00C16926, 00C16A75
summary, xrefs: 00C169BC
content, xrefs: 00C16AAE
published, xrefs: 00C169F8
author, xrefs: 00C16909, 00C16A3C
feclient.dll, xrefs: 00C169D7
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 00C16BDD

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: String$Compare$Free
String ID: ($`<u$author$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp$cabinet.dll$category$clbcatq.dll$content$feclient.dll$link$msi.dll$published$summary$title$updated$version.dll
API String ID: 318886736-1823403471
Opcode ID: 98440b5f44d27b529bbdda1b420d109ef6e758c89f66fc514aad3828f85d6b3d
Instruction ID: b1baf89c783cc04fcb53ff82e54da6ed845475e10f59093ef381bf0c012dbc3a
Opcode Fuzzy Hash: 98440b5f44d27b529bbdda1b420d109ef6e758c89f66fc514aad3828f85d6b3d
Instruction Fuzzy Hash: 24A15071948226BBDB219B94CC41FEDB768AF06724F208365F521EA1D1D770EA90FB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD10E Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 283synchronizationprocessCOMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 00BFD183
StringFromGUID2.OLE32(?,?,00000027), ref: 00BFD1AC
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?,?,?,?,?), ref: 00BFD295
GetLastError.KERNEL32(?,?,?,?), ref: 00BFD29F
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00000064,?,?,?,?), ref: 00BFD338
WaitForSingleObject.KERNEL32(00C1A500,000000FF,?,?,?,?), ref: 00BFD343
ReleaseMutex.KERNEL32(00C1A500,?,?,?,?), ref: 00BFD36D
GetExitCodeProcess.KERNEL32(?,?), ref: 00BFD38E
GetLastError.KERNEL32(?,?,?,?), ref: 00BFD39C
GetLastError.KERNEL32(?,?,?,?), ref: 00BFD3D4

Part of subcall function 00BFD016: WaitForSingleObject.KERNEL32(?,000000FF,74DF30B0,00000000,?,?,?,00BFD312,?), ref: 00BFD035
Part of subcall function 00BFD016: ReleaseMutex.KERNEL32(?,?,?,00BFD312,?), ref: 00BFD049
Part of subcall function 00BFD016: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BFD08E
Part of subcall function 00BFD016: ReleaseMutex.KERNEL32(?), ref: 00BFD0A1
Part of subcall function 00BFD016: SetEvent.KERNEL32(?), ref: 00BFD0AA

CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 00BFD47D
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?), ref: 00BFD495

Strings

Failed to allocate netfx chainer arguments., xrefs: 00BFD263
Failed to allocate section name., xrefs: 00BFD1ED
Failed to create netfx chainer., xrefs: 00BFD22E
Failed to convert netfx chainer guid into string., xrefs: 00BFD1CB
NetFxEvent.%ls, xrefs: 00BFD1FB
NetFxSection.%ls, xrefs: 00BFD1D9
Failed to wait for netfx chainer process to complete, xrefs: 00BFD402
Failed to create netfx chainer guid., xrefs: 00BFD190
%ls /pipe %ls, xrefs: 00BFD24F
D, xrefs: 00BFD27A
c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp, xrefs: 00BFD1C1, 00BFD2C3, 00BFD3C0, 00BFD3F8
Failed to process netfx chainer message., xrefs: 00BFD318
Failed to get netfx return code., xrefs: 00BFD3CA
Failed to allocate event name., xrefs: 00BFD20F
Failed to CreateProcess on path: %ls, xrefs: 00BFD2CE

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Wait$ErrorLastMutexObjectReleaseSingle$CloseCreateHandleProcess$CodeEventExitFromMultipleObjectsStringUuid
String ID: %ls /pipe %ls$D$Failed to CreateProcess on path: %ls$Failed to allocate event name.$Failed to allocate netfx chainer arguments.$Failed to allocate section name.$Failed to convert netfx chainer guid into string.$Failed to create netfx chainer guid.$Failed to create netfx chainer.$Failed to get netfx return code.$Failed to process netfx chainer message.$Failed to wait for netfx chainer process to complete$NetFxEvent.%ls$NetFxSection.%ls$c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp
API String ID: 1533322865-308814414
Opcode ID: 082a9b2a9c945f676b7c4d2de65e0cfa2ad409cb49b382ff5d223901dadaf94b
Instruction ID: 3eef32710e343c1dcf0ff05f5bde9bbd13e3ca47d558b832ed164dedf9c791b8
Opcode Fuzzy Hash: 082a9b2a9c945f676b7c4d2de65e0cfa2ad409cb49b382ff5d223901dadaf94b
Instruction Fuzzy Hash: 79A1B132D4022CABDB219BA4DD41BAEB7F5BF04710F1041B9EA08FB251E7359D498F91

Uniqueness

Uniqueness Score: -1.00%

Function 00BE545D Relevance: 45.7, APIs: 17, Strings: 9, Instructions: 228filepipesleepCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,?,00C1A500,?,00000000,?,00BD457C,?,00C1A500), ref: 00BE547E
GetCurrentProcessId.KERNEL32(?,00BD457C,?,00C1A500), ref: 00BE5489
SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,00BD457C,?,00C1A500), ref: 00BE54C0
ConnectNamedPipe.KERNEL32(?,00000000,?,00BD457C,?,00C1A500), ref: 00BE54D5
GetLastError.KERNEL32(?,00BD457C,?,00C1A500), ref: 00BE54DF
Sleep.KERNEL32(00000064,?,00BD457C,?,00C1A500), ref: 00BE5514
SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,00BD457C,?,00C1A500), ref: 00BE5537
WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,00BD457C,?,00C1A500), ref: 00BE5552
WriteFile.KERNEL32(?,00BD457C,00C1A500,00000000,00000000,?,00BD457C,?,00C1A500), ref: 00BE556D
WriteFile.KERNEL32(?,?,00000004,00000000,00000000,?,00BD457C,?,00C1A500), ref: 00BE5588
ReadFile.KERNEL32(?,00000000,00000004,00000000,00000000,?,00BD457C,?,00C1A500), ref: 00BE55A3
GetLastError.KERNEL32(?,00BD457C,?,00C1A500), ref: 00BE55FE
GetLastError.KERNEL32(?,00BD457C,?,00C1A500), ref: 00BE5632
GetLastError.KERNEL32(?,00BD457C,?,00C1A500), ref: 00BE5666
GetLastError.KERNEL32(?,00BD457C,?,00C1A500), ref: 00BE569A
GetLastError.KERNEL32(?,00BD457C,?,00C1A500), ref: 00BE56CB
GetLastError.KERNEL32(?,00BD457C,?,00C1A500), ref: 00BE56FC

Strings

Failed to write secret length to pipe., xrefs: 00BE56C4
Failed to write secret to pipe., xrefs: 00BE5690
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 00BE55EA, 00BE561E, 00BE5652, 00BE5686, 00BE56BA, 00BE56EB, 00BE571C
Failed to write our process id to pipe., xrefs: 00BE565C
Failed to wait for child to connect to pipe., xrefs: 00BE55F4
Failed to reset pipe to blocking., xrefs: 00BE56F5
Failed to read ACK from pipe., xrefs: 00BE5628
crypt32.dll, xrefs: 00BE5550
Failed to set pipe to non-blocking., xrefs: 00BE5726

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$File$NamedPipeWrite$HandleState$ConnectCurrentProcessReadSleeplstrlen
String ID: Failed to read ACK from pipe.$Failed to reset pipe to blocking.$Failed to set pipe to non-blocking.$Failed to wait for child to connect to pipe.$Failed to write our process id to pipe.$Failed to write secret length to pipe.$Failed to write secret to pipe.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp$crypt32.dll
API String ID: 2944378912-152052350
Opcode ID: 599b3cb0eb6c77ffce0028b61162a2e3898c8dd2db032c4f113eddcf5bbf41bc
Instruction ID: 4297b42ea2eb11b9c5eaa91b935a2a5c19e3c3999eca02365d1c50ff2fb82a0a
Opcode Fuzzy Hash: 599b3cb0eb6c77ffce0028b61162a2e3898c8dd2db032c4f113eddcf5bbf41bc
Instruction Fuzzy Hash: DA6118B7D41675BBD7309AA69D45FAEB6E8AF00B14F1241A1BD01FB280E778CD0087E1

Uniqueness

Uniqueness Score: -1.00%

Function 00BDA3D4 Relevance: 44.1, APIs: 8, Strings: 17, Instructions: 311registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00BDA418
_MREFOpen@16.MSPDB140-MSVCRT ref: 00BDA440
RegCloseKey.ADVAPI32(00000000,?,00000000,?,?,?,?,?), ref: 00BDA73F

Strings

c:\agent\_work\66\s\src\burn\engine\search.cpp, xrefs: 00BDA510, 00BDA545, 00BDA598, 00BDA6A1
Failed to format value string., xrefs: 00BDA44D
Failed to clear variable., xrefs: 00BDA49E
Unsupported registry key value type. Type = '%u', xrefs: 00BDA5D2
Failed to format key string., xrefs: 00BDA425
Registry key not found. Key = '%ls', xrefs: 00BDA478
Failed to query registry key value size., xrefs: 00BDA51C
Failed to query registry key value., xrefs: 00BDA5A4
Failed to get expand environment string., xrefs: 00BDA6AD
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 00BDA4E2
Failed to set variable., xrefs: 00BDA701
Failed to change value type., xrefs: 00BDA6E3, 00BDA706
Failed to allocate string buffer., xrefs: 00BDA633
Failed to open registry key., xrefs: 00BDA4B3
Failed to read registry value., xrefs: 00BDA6C8
RegistrySearchValue failed: ID '%ls', HRESULT 0x%x, xrefs: 00BDA717
Failed to allocate memory registry value., xrefs: 00BDA54F

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Open@16$Close
String ID: Failed to allocate memory registry value.$Failed to allocate string buffer.$Failed to change value type.$Failed to clear variable.$Failed to format key string.$Failed to format value string.$Failed to get expand environment string.$Failed to open registry key.$Failed to query registry key value size.$Failed to query registry key value.$Failed to read registry value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchValue failed: ID '%ls', HRESULT 0x%x$Unsupported registry key value type. Type = '%u'$c:\agent\_work\66\s\src\burn\engine\search.cpp
API String ID: 2348241696-2754605460
Opcode ID: 1709810924c2c9ce0c0c5568c81e4b9e3d1deb988398b7b00e1d1fe3e64843cd
Instruction ID: db20528d2211fe385a5c3a012c83d7e1d0bbeb5d698f3ecba6910d67f3784631
Opcode Fuzzy Hash: 1709810924c2c9ce0c0c5568c81e4b9e3d1deb988398b7b00e1d1fe3e64843cd
Instruction Fuzzy Hash: 79A1C372E00125EBCF119AA4D845AEEFAF9EF08710F1481A6F902B6351F675DD40AB92

Uniqueness

Uniqueness Score: -1.00%

Function 00BD57A7 Relevance: 42.5, APIs: 5, Strings: 19, Instructions: 477stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000100,00000100,00000100,00000000,00000100,00000000,?,00BDA889,00000100,000002C0,000002C0,00000100), ref: 00BD57CC
lstrlenW.KERNEL32(000002C0,?,00BDA889,00000100,000002C0,000002C0,00000100), ref: 00BD57D6
_wcschr.LIBVCRUNTIME ref: 00BD59DB
LeaveCriticalSection.KERNEL32(00000100,00000000,000002C0,000002C0,00000000,000002C0,00000001,?,00BDA889,00000100,000002C0,000002C0,00000100), ref: 00BD5C7E

Strings

Failed to allocate buffer for format string., xrefs: 00BD57F4
Failed to format placeholder string., xrefs: 00BD5A8B
Failed to get variable name., xrefs: 00BD5AC0
Failed to format record., xrefs: 00BD5C42
Failed to copy string., xrefs: 00BD5C62
Failed to get formatted length., xrefs: 00BD5BC6
Failed to append placeholder., xrefs: 00BD5A81
Failed to set record string., xrefs: 00BD5B94
*****, xrefs: 00BD594D
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00BD5A32, 00BD5A53, 00BD5AAC, 00BD5AFE, 00BD5B8A, 00BD5BBC, 00BD5C38
Failed to set variable value., xrefs: 00BD5A95
Failed to allocate string., xrefs: 00BD5BF5
Failed to set record format string., xrefs: 00BD5B08
Failed to append string., xrefs: 00BD5852
Failed to reallocate variable array., xrefs: 00BD5A60
Failed to determine variable visibility: '%ls'., xrefs: 00BD5A6E
[%d], xrefs: 00BD5996
Failed to allocate record., xrefs: 00BD5A3F
Failed to allocate variable array., xrefs: 00BD5AB9

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave_wcschrlstrlen
String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 1026845265-1173883696
Opcode ID: fd72a6f4da6b349c2f45b5d57a4935efb531078b3a849bd5f9b268c31c485ec9
Instruction ID: fb615e62d50343caeb7c15cd5b607ac1b880f0a936619c4c0f5640033b5b8273
Opcode Fuzzy Hash: fd72a6f4da6b349c2f45b5d57a4935efb531078b3a849bd5f9b268c31c485ec9
Instruction Fuzzy Hash: 34F1A471D41625ABDB209F648881EBFBBE4EB04B50F1481ABF915AB340F7359E41DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BFCB5D Relevance: 40.5, APIs: 12, Strings: 11, Instructions: 239synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD39DF: GetProcessHeap.KERNEL32(?,000001C7,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F0
Part of subcall function 00BD39DF: RtlAllocateHeap.NTDLL(00000000,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F7

CreateEventW.KERNEL32(00000000,00000000,00000000,?,00000000,00000018,00000001,?,00000000,?,?,00BFD228,?,?,?), ref: 00BFCBA3
GetLastError.KERNEL32(?,?,00BFD228,?,?,?), ref: 00BFCBB0
ReleaseMutex.KERNEL32(?), ref: 00BFCE18

Strings

%ls_send, xrefs: 00BFCBE2
Failed to create mutex: %ls, xrefs: 00BFCCB2
failed to allocate memory for mutex name, xrefs: 00BFCC65
Failed to create event: %ls, xrefs: 00BFCC43
failed to copy event name to shared memory structure., xrefs: 00BFCD76
Failed to allocate memory for NetFxChainer struct., xrefs: 00BFCB89
c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp, xrefs: 00BFCB7F, 00BFCBD1, 00BFCC36, 00BFCCA5, 00BFCCF7, 00BFCD3F
Failed to memory map cabinet file: %ls, xrefs: 00BFCD04
%ls_mutex, xrefs: 00BFCC51
Failed to MapViewOfFile for %ls., xrefs: 00BFCD4C
failed to allocate memory for event name, xrefs: 00BFCBF6

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Heap$AllocateCreateErrorEventLastMutexProcessRelease
String ID: %ls_mutex$%ls_send$Failed to MapViewOfFile for %ls.$Failed to allocate memory for NetFxChainer struct.$Failed to create event: %ls$Failed to create mutex: %ls$Failed to memory map cabinet file: %ls$c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp$failed to allocate memory for event name$failed to allocate memory for mutex name$failed to copy event name to shared memory structure.
API String ID: 3944734951-2874813099
Opcode ID: c443263e0a99d123c2c88672486c7e0e367522e509139231a16e5b4ec55092f3
Instruction ID: ce8451db67365b9063f6ad92b86251b223f73fcbe4ec4d37407ff7337f570b3e
Opcode Fuzzy Hash: c443263e0a99d123c2c88672486c7e0e367522e509139231a16e5b4ec55092f3
Instruction Fuzzy Hash: B781157694163EBBC7218B649E49FAABEE4FF04710F0141B5FE08AB241E634DD84D6E1

Uniqueness

Uniqueness Score: -1.00%

Function 00BDE9FC Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 230COMMON

Download Yara Rule

APIs

Part of subcall function 00C12B5D: VariantInit.OLEAUT32(?), ref: 00C12B73
Part of subcall function 00C12B5D: SysAllocString.OLEAUT32(?), ref: 00C12B8F
Part of subcall function 00C12B5D: VariantClear.OLEAUT32(?), ref: 00C12C16
Part of subcall function 00C12B5D: SysFreeString.OLEAUT32(00000000), ref: 00C12C21

CompareStringW.KERNEL32(0000007F,00000000,000000FF,000000FF,Detect,000000FF,?,00C1BB64,?,?,Action,?,?,?,00000000,00BD5482), ref: 00BDEACD
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,Upgrade,000000FF), ref: 00BDEB17

Strings

Failed to get next RelatedBundle element., xrefs: 00BDEC2A
Failed to resize Detect code array in registration, xrefs: 00BDEBE8
Failed to get RelatedBundle nodes, xrefs: 00BDEA2C
Invalid value for @Action: %ls, xrefs: 00BDEC0C
comres.dll, xrefs: 00BDEAE0
cabinet.dll, xrefs: 00BDEB74
Failed to resize Upgrade code array in registration, xrefs: 00BDEBEF
Failed to get RelatedBundle element count., xrefs: 00BDEA51
Addon, xrefs: 00BDEB54
Failed to get @Action., xrefs: 00BDEC23
Failed to get @Id., xrefs: 00BDEC1C
Failed to resize Patch code array in registration, xrefs: 00BDEBFD
version.dll, xrefs: 00BDEB2A
Failed to resize Addon code array in registration, xrefs: 00BDEBF6
Detect, xrefs: 00BDEABE
Patch, xrefs: 00BDEB97
Action, xrefs: 00BDEA8A
Upgrade, xrefs: 00BDEB0A
RelatedBundle, xrefs: 00BDEA0A

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: String$CompareVariant$AllocClearFreeInit
String ID: Action$Addon$Detect$Failed to get @Action.$Failed to get @Id.$Failed to get RelatedBundle element count.$Failed to get RelatedBundle nodes$Failed to get next RelatedBundle element.$Failed to resize Addon code array in registration$Failed to resize Detect code array in registration$Failed to resize Patch code array in registration$Failed to resize Upgrade code array in registration$Invalid value for @Action: %ls$Patch$RelatedBundle$Upgrade$cabinet.dll$comres.dll$version.dll
API String ID: 702752599-259800149
Opcode ID: 1c56a1d1e2ef7f47c51b80fc3315c3373e1e4449e8422cfb9a1b8a4fafcb971b
Instruction ID: 97b3107a5be9295d17417069116e4c69f11e456aac75455cfc2552f0f2430997
Opcode Fuzzy Hash: 1c56a1d1e2ef7f47c51b80fc3315c3373e1e4449e8422cfb9a1b8a4fafcb971b
Instruction Fuzzy Hash: 3A71A331A44626BBCB10AB54C981EADF7F4FB15720F2442A6E921AB781E730ED51DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BE4668 Relevance: 36.9, APIs: 10, Strings: 11, Instructions: 184fileCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,8000FFFF,feclient.dll,?,00BE4B7B,00C1A4E8,?,feclient.dll,00000000,?,?), ref: 00BE467F
ReadFile.KERNEL32(feclient.dll,feclient.dll,00000004,?,00000000,?,00BE4B7B,00C1A4E8,?,feclient.dll,00000000,?,?), ref: 00BE46A0
GetLastError.KERNEL32(?,00BE4B7B,00C1A4E8,?,feclient.dll,00000000,?,?), ref: 00BE46A6
ReadFile.KERNEL32(feclient.dll,00000000,00C1A518,?,00000000,00000000,00C1A519,?,00BE4B7B,00C1A4E8,?,feclient.dll,00000000,?,?), ref: 00BE4734
GetLastError.KERNEL32(?,00BE4B7B,00C1A4E8,?,feclient.dll,00000000,?,?), ref: 00BE473A

Strings

Verification secret from parent does not match., xrefs: 00BE47A2
Failed to read size of verification secret from parent pipe., xrefs: 00BE46D4
Failed to allocate buffer for verification secret., xrefs: 00BE471D
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 00BE46CA, 00BE46F5, 00BE475E, 00BE4796, 00BE47E3, 00BE483D, 00BE487B
Failed to read verification secret from parent pipe., xrefs: 00BE4768
Failed to read verification process id from parent pipe., xrefs: 00BE47ED
Verification secret from parent is too big., xrefs: 00BE4701
Verification process id from parent does not match., xrefs: 00BE4887
feclient.dll, xrefs: 00BE466E, 00BE469E, 00BE469F, 00BE4733, 00BE47B8, 00BE480E
msasn1.dll, xrefs: 00BE47B7
Failed to inform parent process that child is running., xrefs: 00BE4847

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorFileLastRead$CurrentProcess
String ID: Failed to allocate buffer for verification secret.$Failed to inform parent process that child is running.$Failed to read size of verification secret from parent pipe.$Failed to read verification process id from parent pipe.$Failed to read verification secret from parent pipe.$Verification process id from parent does not match.$Verification secret from parent does not match.$Verification secret from parent is too big.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp$feclient.dll$msasn1.dll
API String ID: 1233551569-1273669510
Opcode ID: bb9bcf3cadb0d7af0112d33119b6b1eb63d0ea18a343eaa2ed797aff2e22993f
Instruction ID: c70b024fd5667d74abc6a327b45570d1a367c2221e3589be819e3fd1db12aafb
Opcode Fuzzy Hash: bb9bcf3cadb0d7af0112d33119b6b1eb63d0ea18a343eaa2ed797aff2e22993f
Instruction Fuzzy Hash: 01512B36E402B6BBD7119A955C41FAFB6E8BF01B10F1141A5BE11BB281D77C8E0097E1

Uniqueness

Uniqueness Score: -1.00%

Function 00BF2596 Relevance: 36.9, APIs: 3, Strings: 18, Instructions: 144COMMON

Download Yara Rule

Strings

Failed to parse command lines., xrefs: 00BF2722
Failed to get @Protocol., xrefs: 00BF270E
netfx4, xrefs: 00BF26AF
Repairable, xrefs: 00BF2636
UninstallArguments, xrefs: 00BF25F2
RepairArguments, xrefs: 00BF2614
Failed to get @RepairArguments., xrefs: 00BF2625
InstallArguments, xrefs: 00BF25D0
none, xrefs: 00BF26D0
Failed to get @DetectCondition., xrefs: 00BF25BF
DetectCondition, xrefs: 00BF25AE
Invalid protocol type: %ls, xrefs: 00BF26F6
Failed to get @UninstallArguments., xrefs: 00BF2603
Protocol, xrefs: 00BF265D
Failed to get @Repairable., xrefs: 00BF264F
Failed to parse exit codes., xrefs: 00BF26A6
Failed to get @InstallArguments., xrefs: 00BF25E1
burn, xrefs: 00BF267A

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: DetectCondition$Failed to get @DetectCondition.$Failed to get @InstallArguments.$Failed to get @Protocol.$Failed to get @RepairArguments.$Failed to get @Repairable.$Failed to get @UninstallArguments.$Failed to parse command lines.$Failed to parse exit codes.$InstallArguments$Invalid protocol type: %ls$Protocol$RepairArguments$Repairable$UninstallArguments$burn$netfx4$none
API String ID: 760788290-1911311241
Opcode ID: 40eed570b2d9058668def872d4148824056d77fc3b5da5565011a75c5ad295bd
Instruction ID: c2cb8d3130f9b9c91b0a5d6666ef9901e86bdaff41f0635bfa904afa43147a44
Opcode Fuzzy Hash: 40eed570b2d9058668def872d4148824056d77fc3b5da5565011a75c5ad295bd
Instruction Fuzzy Hash: D9412A32A8473AF7CB12A7649D42FBA76989B01B30F2003A1FA24B76D1D764DD0957D2

Uniqueness

Uniqueness Score: -1.00%

Function 00BD8F3F Relevance: 35.4, APIs: 8, Strings: 12, Instructions: 430COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(00000001,5600C1CC,00000001,?,00BD990B,?,00000000,00000000,?,?,00BD98F3,?,?,00000000,?), ref: 00BD8F7D

Strings

Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d., xrefs: 00BD91AB
Failed to parse condition "%ls". Unexpected '~' operator at position %d., xrefs: 00BD93D5
Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d., xrefs: 00BD9391
-, xrefs: 00BD90E5
c:\agent\_work\66\s\src\burn\engine\condition.cpp, xrefs: 00BD9051, 00BD911B, 00BD9197, 00BD91FB, 00BD9339, 00BD937D, 00BD93C1
NOT, xrefs: 00BD92A8
Failed to parse condition "%ls". Invalid version format, at position %d., xrefs: 00BD920F
Failed to parse condition "%ls". Constant too big, at position %d., xrefs: 00BD934D
Failed to parse condition "%ls". Unexpected character at position %d., xrefs: 00BD912F
Failed to parse condition "%ls". Unterminated literal at position %d., xrefs: 00BD9065
AND, xrefs: 00BD9289
Failed to set symbol value., xrefs: 00BD902D

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: StringType
String ID: -$AND$Failed to parse condition "%ls". Constant too big, at position %d.$Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d.$Failed to parse condition "%ls". Invalid version format, at position %d.$Failed to parse condition "%ls". Unexpected '~' operator at position %d.$Failed to parse condition "%ls". Unexpected character at position %d.$Failed to parse condition "%ls". Unterminated literal at position %d.$Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d.$Failed to set symbol value.$NOT$c:\agent\_work\66\s\src\burn\engine\condition.cpp
API String ID: 4177115715-1494984065
Opcode ID: 1155971329d0fbb7bd24a4a5b1cc548bf528e0bea36aeb536967d9d79dd85f6d
Instruction ID: a2176aa776607edc05bb9685d1b68e9e2cc3415c7936c7b8e81ab6f8e6c0f0b5
Opcode Fuzzy Hash: 1155971329d0fbb7bd24a4a5b1cc548bf528e0bea36aeb536967d9d79dd85f6d
Instruction Fuzzy Hash: 8CF1F371540211FBDB24CF54C889BEAFBE5FB05714F10819BF9059A386E3B5DA92DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00BF1951 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 211COMMON

Download Yara Rule

APIs

Part of subcall function 00BD39DF: GetProcessHeap.KERNEL32(?,000001C7,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F0
Part of subcall function 00BD39DF: RtlAllocateHeap.NTDLL(00000000,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F7

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,success,000000FF,?,Type,00000000,?,?,00000000,?,00000001,?), ref: 00BF1A58
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,error,000000FF), ref: 00BF1A76

Strings

Type, xrefs: 00BF1A30
Code, xrefs: 00BF1AC5
error, xrefs: 00BF1A69
Failed to get exit code node count., xrefs: 00BF19A3
ExitCode, xrefs: 00BF195F
Invalid exit code type: %ls, xrefs: 00BF1B47
Failed to allocate memory for exit code structs., xrefs: 00BF19E3
c:\agent\_work\66\s\src\burn\engine\exeengine.cpp, xrefs: 00BF19D9
Failed to get @Type., xrefs: 00BF1B57
Failed to parse @Code value: %ls, xrefs: 00BF1B31
scheduleReboot, xrefs: 00BF1A85
Failed to get @Code., xrefs: 00BF1B38
success, xrefs: 00BF1A49
Failed to select exit code nodes., xrefs: 00BF197E
Failed to get next node., xrefs: 00BF1B5E
forceReboot, xrefs: 00BF1AA3

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CompareHeapString$AllocateProcess
String ID: Code$ExitCode$Failed to allocate memory for exit code structs.$Failed to get @Code.$Failed to get @Type.$Failed to get exit code node count.$Failed to get next node.$Failed to parse @Code value: %ls$Failed to select exit code nodes.$Invalid exit code type: %ls$Type$c:\agent\_work\66\s\src\burn\engine\exeengine.cpp$error$forceReboot$scheduleReboot$success
API String ID: 2664528157-2974551199
Opcode ID: 0519a1c8af63ee22d07b1d3f03f9253d8d92be6a2a2763e5c9f136aacc3bd6b1
Instruction ID: 1f45edd0ae0dc92c8f7fd7950ec0a4d541e163d595026a4352067fc8b357e0c1
Opcode Fuzzy Hash: 0519a1c8af63ee22d07b1d3f03f9253d8d92be6a2a2763e5c9f136aacc3bd6b1
Instruction Fuzzy Hash: 2361F630A0522AFBCB109B58CC41EBEBBE5EF41720F204AA5F524AB2D1D7709E45DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00BE6AC2 Relevance: 33.6, APIs: 6, Strings: 13, Instructions: 355synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDD461: EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,00BE6F37,000000B8,00000000,?,00000000,75C0B390), ref: 00BDD470
Part of subcall function 00BDD461: InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 00BDD47F
Part of subcall function 00BDD461: LeaveCriticalSection.KERNEL32(000000D0,?,00BE6F37,000000B8,00000000,?,00000000,75C0B390), ref: 00BDD494

ReleaseMutex.KERNEL32(00000000,?,00000000,crypt32.dll,00000000,00000001,00000000), ref: 00BE6E86
CloseHandle.KERNEL32(00000000), ref: 00BE6E8F
CloseHandle.KERNEL32(?,?,00000000,crypt32.dll,00000000,00000001,00000000), ref: 00BE6EAF

Part of subcall function 00BFB9F8: SetThreadExecutionState.KERNEL32(80000001), ref: 00BFB9FD

Strings

Failed to elevate., xrefs: 00BE6C8E
comres.dll, xrefs: 00BE6ED5
c:\agent\_work\66\s\src\burn\engine\core.cpp, xrefs: 00BE6B8A, 00BE6D5B
Failed to cache engine to working directory., xrefs: 00BE6C68
Failed while caching, aborting execution., xrefs: 00BE6D8D
Failed to create cache thread., xrefs: 00BE6D65
Failed to register bundle., xrefs: 00BE6CEB
Failed to set initial apply variables., xrefs: 00BE6BFE
UX aborted apply begin., xrefs: 00BE6B94
Another per-machine setup is already executing., xrefs: 00BE6CC8
Another per-user setup is already executing., xrefs: 00BE6BD4
Engine cannot start apply because it is busy with another action., xrefs: 00BE6B23
crypt32.dll, xrefs: 00BE6BC6

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseCriticalHandleSection$CompareEnterExchangeExecutionInterlockedLeaveMutexReleaseStateThread
String ID: Another per-machine setup is already executing.$Another per-user setup is already executing.$Engine cannot start apply because it is busy with another action.$Failed to cache engine to working directory.$Failed to create cache thread.$Failed to elevate.$Failed to register bundle.$Failed to set initial apply variables.$Failed while caching, aborting execution.$UX aborted apply begin.$c:\agent\_work\66\s\src\burn\engine\core.cpp$comres.dll$crypt32.dll
API String ID: 1740103319-621563166
Opcode ID: 9221af08bf88bfdbcbaffaa1815ccd0230da149d7626ac8e3414e563193b10e1
Instruction ID: 1248442f94d9e36104b05c779f58c6f59e5ad2baddad53f53582c7af924a8d5b
Opcode Fuzzy Hash: 9221af08bf88bfdbcbaffaa1815ccd0230da149d7626ac8e3414e563193b10e1
Instruction Fuzzy Hash: EEC19271901265ABDF159FA1C885FEE3BE8EF24351F1481FAFD05AA242DB309944CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00C16FC4 Relevance: 33.5, APIs: 8, Strings: 11, Instructions: 205COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,rel,000000FF,?,?,?,00000000), ref: 00C17024
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,href,000000FF), ref: 00C17049
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,length,000000FF), ref: 00C17069
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 00C1709C
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,type,000000FF), ref: 00C170B8
SysFreeString.OLEAUT32(00000000), ref: 00C170E3
SysFreeString.OLEAUT32(00000000), ref: 00C1715A
SysFreeString.OLEAUT32(00000000), ref: 00C171A6

Strings

msi.dll, xrefs: 00C17142
href, xrefs: 00C1703B
title, xrefs: 00C1708E
rel, xrefs: 00C17017
version.dll, xrefs: 00C170C7
`<u, xrefs: 00C170E3, 00C1715A, 00C171A6
type, xrefs: 00C170AA
length, xrefs: 00C1705B
comres.dll, xrefs: 00C17073
feclient.dll, xrefs: 00C17056
msasn1.dll, xrefs: 00C17194

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: String$Compare$Free
String ID: `<u$comres.dll$feclient.dll$href$length$msasn1.dll$msi.dll$rel$title$type$version.dll
API String ID: 318886736-782967201
Opcode ID: ac6b0049cf2ba91a7be2b8c7e3b5ea773bd73fc45d217e418945e2330fe9aff7
Instruction ID: 949bd49a3e39df7e7eedfce0a35eda604354cc0f05a2dc3fd07dce633aadbabc
Opcode Fuzzy Hash: ac6b0049cf2ba91a7be2b8c7e3b5ea773bd73fc45d217e418945e2330fe9aff7
Instruction Fuzzy Hash: 21612131908219FBCB15DB94CC45FEEB7B8AF0A320F2043A5E525A71A0D731AF94EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C178F7 Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 308COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,00000410), ref: 00C17924
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF), ref: 00C1793F
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,upgrade,000000FF), ref: 00C179E2
CompareStringW.KERNEL32(0000007F,00000000,00700079,000000FF,version,000000FF,000002D8,00C1A518,00000000), ref: 00C17A21
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exclusive,000000FF), ref: 00C17A74
CompareStringW.KERNEL32(0000007F,00000000,00C1A518,000000FF,true,000000FF), ref: 00C17A92
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 00C17ACA
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,enclosure,000000FF), ref: 00C17C0E

Strings

version, xrefs: 00C17A13, 00C17ABC
application, xrefs: 00C17931
http://appsyndication.org/2006/appsyn, xrefs: 00C17917
upgrade, xrefs: 00C179D4
type, xrefs: 00C1796A
exclusive, xrefs: 00C17A66
c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp, xrefs: 00C17B31
true, xrefs: 00C17A84
enclosure, xrefs: 00C17BFC

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CompareString
String ID: application$c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp$enclosure$exclusive$http://appsyndication.org/2006/appsyn$true$type$upgrade$version
API String ID: 1825529933-3624447555
Opcode ID: f221ff92d4ac3a5eddf97f9ca2882ae9c76cbcf6433279b70ebf22ba5da3e551
Instruction ID: 5e412596df7b74a1e3291a4b9e4e628224953a425776ea5b700a865a9c674e22
Opcode Fuzzy Hash: f221ff92d4ac3a5eddf97f9ca2882ae9c76cbcf6433279b70ebf22ba5da3e551
Instruction Fuzzy Hash: D0B19B71548206ABDB209F58CC81F9A77B5AF06730F208765F935AB3D5DB70EA81EB40

Uniqueness

Uniqueness Score: -1.00%

Function 00BEE226 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 145registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BEE10F: LoadBitmapW.USER32(?,00000001), ref: 00BEE145
Part of subcall function 00BEE10F: GetLastError.KERNEL32 ref: 00BEE151

LoadCursorW.USER32(00000000,00007F00), ref: 00BEE287
RegisterClassW.USER32(?), ref: 00BEE29B
GetLastError.KERNEL32 ref: 00BEE2A6
UnregisterClassW.USER32(WixBurnSplashScreen,?), ref: 00BEE3AB
DeleteObject.GDI32(00000000), ref: 00BEE3BA

Strings

c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp, xrefs: 00BEE2CA, 00BEE333
Failed to create window., xrefs: 00BEE33D
Failed to register window., xrefs: 00BEE2D4
WixBurnSplashScreen, xrefs: 00BEE294, 00BEE3A6
Failed to load splash screen., xrefs: 00BEE25F
Unexpected return value from message pump., xrefs: 00BEE395

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ClassErrorLastLoad$BitmapCursorDeleteObjectRegisterUnregister
String ID: Failed to create window.$Failed to load splash screen.$Failed to register window.$Unexpected return value from message pump.$WixBurnSplashScreen$c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp
API String ID: 164797020-1158544062
Opcode ID: b9fc75276a46f1b88330fcb4bf996389b601590a3d20315eada3f0fa4b82b620
Instruction ID: e2a9aec2f6326dbc4973723397537f83f39cb69df0390c6162d4cf398005cb1b
Opcode Fuzzy Hash: b9fc75276a46f1b88330fcb4bf996389b601590a3d20315eada3f0fa4b82b620
Instruction Fuzzy Hash: 6A41B272901269BFDB119BE5DD45FAEBBB9FF08700F104165FA11B6150D734DD048BA2

Uniqueness

Uniqueness Score: -1.00%

Function 00BF9B0F Relevance: 30.0, APIs: 4, Strings: 13, Instructions: 232threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000001,00BFB978,00000000,000000FF,00000001,00000000,00000000,00BFB978,00000001,?), ref: 00BF9B74
GetLastError.KERNEL32 ref: 00BF9CE4
GetExitCodeThread.KERNEL32(?,00000001), ref: 00BF9D24
GetLastError.KERNEL32 ref: 00BF9D2E

Strings

Failed to execute package provider registration action., xrefs: 00BF9C45
Invalid execute action., xrefs: 00BF9D84
Cache thread exited unexpectedly., xrefs: 00BF9D75
Failed to execute dependency action., xrefs: 00BF9C64
Failed to load compatible package on per-machine package., xrefs: 00BF9C8A
Failed to execute MSU package., xrefs: 00BF9C29
Failed to get cache thread exit code., xrefs: 00BF9D5F
Failed to execute compatible package action., xrefs: 00BF9CA1
Failed to execute EXE package., xrefs: 00BF9BAB
Failed to execute MSP package., xrefs: 00BF9BF9
Failed to wait for cache check-point., xrefs: 00BF9D15
c:\agent\_work\66\s\src\burn\engine\apply.cpp, xrefs: 00BF9D0B, 00BF9D55
Failed to execute MSI package., xrefs: 00BF9BD4

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$CodeExitMultipleObjectsThreadWait
String ID: Cache thread exited unexpectedly.$Failed to execute EXE package.$Failed to execute MSI package.$Failed to execute MSP package.$Failed to execute MSU package.$Failed to execute compatible package action.$Failed to execute dependency action.$Failed to execute package provider registration action.$Failed to get cache thread exit code.$Failed to load compatible package on per-machine package.$Failed to wait for cache check-point.$Invalid execute action.$c:\agent\_work\66\s\src\burn\engine\apply.cpp
API String ID: 3703294532-2335230991
Opcode ID: 96de1bf85b804330ae094921bc3f83f3d88700015d838e24d13f62bf7d9ca443
Instruction ID: 72bcc73c30231a5548824b7e7a5cce421b976ef0212157ee10f5da9674dd2a9d
Opcode Fuzzy Hash: 96de1bf85b804330ae094921bc3f83f3d88700015d838e24d13f62bf7d9ca443
Instruction Fuzzy Hash: 17716E71A01229EBDB11DF64D941FBE7BF8EB44B10F2081A5FA04F7241D6749E059BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BDF1BA Relevance: 29.9, APIs: 3, Strings: 14, Instructions: 182registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C13349: GetVersionExW.KERNEL32(?,?,?,00000000), ref: 00C13398

RegCloseKey.ADVAPI32(00000000,?,00C1FF38,00020006,00000000,?,00000000,00000000,00000000,?,00000000,00000001,00000000,00000000), ref: 00BDF3EA

Part of subcall function 00C10D39: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,00BDF237,00C1FF38,Resume,00000005,?,00000000,00000000,00000000), ref: 00C10D4E

Strings

Installed, xrefs: 00BDF24F
Failed to create run key., xrefs: 00BDF2C7
Failed to write Resume value., xrefs: 00BDF23D
Failed to write run key value., xrefs: 00BDF2E5
Failed to delete run key value., xrefs: 00BDF378
burn.runonce, xrefs: 00BDF284
BundleResumeCommandLine, xrefs: 00BDF2F2, 00BDF385
Failed to format resume command line for RunOnce., xrefs: 00BDF2A3
Failed to delete resume command line value., xrefs: 00BDF3C6
Failed to write resume command line value., xrefs: 00BDF307
Failed to write Installed value., xrefs: 00BDF260
"%ls" /%ls, xrefs: 00BDF28F
c:\agent\_work\66\s\src\burn\engine\registration.cpp, xrefs: 00BDF36E, 00BDF3BC
Resume, xrefs: 00BDF22C

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseValueVersion
String ID: "%ls" /%ls$BundleResumeCommandLine$Failed to create run key.$Failed to delete resume command line value.$Failed to delete run key value.$Failed to format resume command line for RunOnce.$Failed to write Installed value.$Failed to write Resume value.$Failed to write resume command line value.$Failed to write run key value.$Installed$Resume$burn.runonce$c:\agent\_work\66\s\src\burn\engine\registration.cpp
API String ID: 2348918689-1350441746
Opcode ID: 52f497c0f18d795a9508b4f8d62d8002ded53f50cb8f7f56c64a3f7a24cb99c4
Instruction ID: 7a26dec298a01983a5c17cedeec9d034c7999f98a8bd22b1cffccd68a91a2a80
Opcode Fuzzy Hash: 52f497c0f18d795a9508b4f8d62d8002ded53f50cb8f7f56c64a3f7a24cb99c4
Instruction Fuzzy Hash: 1A51F731944227BBCF119AA0DC42ABEFAE4BF00720F1641B7B90276251E7B49D50E794

Uniqueness

Uniqueness Score: -1.00%

Function 00BFC96F Relevance: 29.9, APIs: 7, Strings: 10, Instructions: 173processCOMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(74DE8FB0,00000000,00000000), ref: 00BFC97B

Part of subcall function 00BE4D1A: UuidCreate.RPCRT4(?), ref: 00BE4D4D

CreateProcessW.KERNEL32(?,?,00000000,00000000,00000001,08000000,00000000,00000000,?,00BF219D,?,?,00000000,?,?,?), ref: 00BFCA59
GetLastError.KERNEL32(?,?,00000000,?,?,?,?), ref: 00BFCA63
GetProcessId.KERNEL32(00BF219D,?,?,00000000,?,?,?,?), ref: 00BFCA9B

Part of subcall function 00BE545D: lstrlenW.KERNEL32(?,?,00000000,?,00C1A500,?,00000000,?,00BD457C,?,00C1A500), ref: 00BE547E
Part of subcall function 00BE545D: GetCurrentProcessId.KERNEL32(?,00BD457C,?,00C1A500), ref: 00BE5489
Part of subcall function 00BE545D: SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,00BD457C,?,00C1A500), ref: 00BE54C0
Part of subcall function 00BE545D: ConnectNamedPipe.KERNEL32(?,00000000,?,00BD457C,?,00C1A500), ref: 00BE54D5
Part of subcall function 00BE545D: GetLastError.KERNEL32(?,00BD457C,?,00C1A500), ref: 00BE54DF
Part of subcall function 00BE545D: Sleep.KERNEL32(00000064,?,00BD457C,?,00C1A500), ref: 00BE5514
Part of subcall function 00BE545D: SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,00BD457C,?,00C1A500), ref: 00BE5537
Part of subcall function 00BE545D: WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,00BD457C,?,00C1A500), ref: 00BE5552
Part of subcall function 00BE545D: WriteFile.KERNEL32(?,00BD457C,00C1A500,00000000,00000000,?,00BD457C,?,00C1A500), ref: 00BE556D
Part of subcall function 00BE545D: WriteFile.KERNEL32(?,?,00000004,00000000,00000000,?,00BD457C,?,00C1A500), ref: 00BE5588

Part of subcall function 00C102EC: WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,00BD4F5D,?,000000FF,?,?,?,?,?,00000000,?,?,?), ref: 00C102F8
Part of subcall function 00C102EC: GetLastError.KERNEL32(?,00BD4F5D,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00C10306

CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,00BFC8CF,?,?,?,?,?,00000000,?,?,?,?), ref: 00BFCB1F
CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,00BFC8CF,?,?,?,?,?,00000000,?,?,?,?), ref: 00BFCB2E
CloseHandle.KERNEL32(00000000,?,?,000000FF,00000000,?,00BFC8CF,?,?,?,?,?,00000000,?,?,?), ref: 00BFCB45

Strings

Failed to allocate embedded command., xrefs: 00BFCA32
c:\agent\_work\66\s\src\burn\engine\embedded.cpp, xrefs: 00BFCA84
Failed to process messages from embedded message., xrefs: 00BFCAE2
Failed to wait for embedded process to connect to pipe., xrefs: 00BFCABD
Failed to create embedded pipe name and client token., xrefs: 00BFC9DE
Failed to create embedded pipe., xrefs: 00BFCA05
Failed to create embedded process at path: %ls, xrefs: 00BFCA91
%ls -%ls %ls %ls %u, xrefs: 00BFCA1E
burn.embedded, xrefs: 00BFCA16
Failed to wait for embedded executable: %ls, xrefs: 00BFCB02

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Handle$Process$CloseErrorFileLastNamedPipeWrite$CreateCurrentState$ConnectObjectSingleSleepUuidWaitlstrlen
String ID: %ls -%ls %ls %ls %u$Failed to allocate embedded command.$Failed to create embedded pipe name and client token.$Failed to create embedded pipe.$Failed to create embedded process at path: %ls$Failed to process messages from embedded message.$Failed to wait for embedded executable: %ls$Failed to wait for embedded process to connect to pipe.$burn.embedded$c:\agent\_work\66\s\src\burn\engine\embedded.cpp
API String ID: 875070380-1877421928
Opcode ID: b8259267e7111e53be0f0fe99876edce97d3bb25b9e88343a871d1aa4353223d
Instruction ID: 50d57bf936fba516e13f3f1f9af7e22aa0e55d1b24f96753b2fa1b5578bbac78
Opcode Fuzzy Hash: b8259267e7111e53be0f0fe99876edce97d3bb25b9e88343a871d1aa4353223d
Instruction Fuzzy Hash: E4518D32D4022DBBDF12DBA4DD42FEEBAF8AF04710F1041A5FA00B7291D7759A859B91

Uniqueness

Uniqueness Score: -1.00%

Function 00BDEC76 Relevance: 29.9, APIs: 2, Strings: 15, Instructions: 172COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 00BDEE04

Part of subcall function 00BD39DF: GetProcessHeap.KERNEL32(?,000001C7,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F0
Part of subcall function 00BD39DF: RtlAllocateHeap.NTDLL(00000000,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F7

SysFreeString.OLEAUT32(?), ref: 00BDEDBC

Strings

Path, xrefs: 00BDED6A
Failed to get SoftwareTag text., xrefs: 00BDEE41
Failed to get @Filename., xrefs: 00BDEE5F
Failed to get @Regid., xrefs: 00BDEE55
Regid, xrefs: 00BDED52
Failed to allocate memory for software tag structs., xrefs: 00BDED03
Failed to get software tag count., xrefs: 00BDECCB
Failed to get @Path., xrefs: 00BDEE4B
`<u, xrefs: 00BDEDBC, 00BDEE04
Failed to convert SoftwareTag text to UTF-8, xrefs: 00BDEE37
c:\agent\_work\66\s\src\burn\engine\registration.cpp, xrefs: 00BDECF9
Filename, xrefs: 00BDED37
SoftwareTag, xrefs: 00BDEC85
Failed to get next node., xrefs: 00BDEE69
Failed to select software tag nodes., xrefs: 00BDECA6

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: FreeHeapString$AllocateProcess
String ID: Failed to allocate memory for software tag structs.$Failed to convert SoftwareTag text to UTF-8$Failed to get @Filename.$Failed to get @Path.$Failed to get @Regid.$Failed to get SoftwareTag text.$Failed to get next node.$Failed to get software tag count.$Failed to select software tag nodes.$Filename$Path$Regid$SoftwareTag$`<u$c:\agent\_work\66\s\src\burn\engine\registration.cpp
API String ID: 336948655-2390364300
Opcode ID: 9323875443d3b52243a122514d0251ed4ab4e4f64059f3ae4d8c49acfd2b22b0
Instruction ID: 449495d70a79813d0ff74181a95f6ef0f0020692dec200dd85f740820244766b
Opcode Fuzzy Hash: 9323875443d3b52243a122514d0251ed4ab4e4f64059f3ae4d8c49acfd2b22b0
Instruction Fuzzy Hash: C451C171A00229EBCB11AF54D881EAEF7F8EF04B14F2441BAB821AF351EB70DD409790

Uniqueness

Uniqueness Score: -1.00%

Function 00C17741 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 153stringCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,msi.dll,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,000002C0,?,00C17C2B,00000001,?), ref: 00C17761
CompareStringW.KERNEL32(0000007F,00000000,digest,000000FF,002E0069,000000FF,?,00C17C2B,00000001,?), ref: 00C1777C
CompareStringW.KERNEL32(0000007F,00000000,name,000000FF,002E0069,000000FF,?,00C17C2B,00000001,?), ref: 00C17797
CompareStringW.KERNEL32(0000007F,00000000,algorithm,000000FF,?,000000FF,?,00C17C2B,00000001,?), ref: 00C17803
CompareStringW.KERNEL32(0000007F,00000001,md5,000000FF,?,000000FF,?,00C17C2B,00000001,?), ref: 00C17827
CompareStringW.KERNEL32(0000007F,00000001,sha1,000000FF,?,000000FF,?,00C17C2B,00000001,?), ref: 00C1784B
CompareStringW.KERNEL32(0000007F,00000001,sha256,000000FF,?,000000FF,?,00C17C2B,00000001,?), ref: 00C1786B
lstrlenW.KERNEL32(006C0064,?,00C17C2B,00000001,?), ref: 00C17886

Strings

msi.dll, xrefs: 00C1775B
sha1, xrefs: 00C17842
name, xrefs: 00C1778E
digest, xrefs: 00C17773
http://appsyndication.org/2006/appsyn, xrefs: 00C17754
sha256, xrefs: 00C17862
c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp, xrefs: 00C1789E
algorithm, xrefs: 00C177FA
md5, xrefs: 00C1781E

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CompareString$lstrlen
String ID: algorithm$c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp$digest$http://appsyndication.org/2006/appsyn$md5$msi.dll$name$sha1$sha256
API String ID: 1657112622-124732866
Opcode ID: 679d5441bd207307c62bdc330ed1ab10e2d73f9fbfc615ef323cae8b86835e54
Instruction ID: 4de77e718be0ae7c04707d385a5b06a5536eca6c3c790a4afad3307e75f1e425
Opcode Fuzzy Hash: 679d5441bd207307c62bdc330ed1ab10e2d73f9fbfc615ef323cae8b86835e54
Instruction Fuzzy Hash: CD51A331688612BBEB214F548C86F95BA71AB12B30F308315FA35BE2D5D764E980D7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00BD9FFE Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 214COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00BDA076

Strings

Trying per-user extended info for property '%ls' for product: %ls, xrefs: 00BDA135
AssignmentType, xrefs: 00BDA051
Product or related product not found: %ls, xrefs: 00BDA161
Failed to get product info., xrefs: 00BDA1A3
Unsupported product search type: %u, xrefs: 00BDA03E
Trying per-machine extended info for property '%ls' for product: %ls, xrefs: 00BDA108
Failed to copy upgrade code., xrefs: 00BDA0D6
VersionString, xrefs: 00BDA066, 00BDA0F1, 00BDA107, 00BDA11B, 00BDA134, 00BDA148
Failed to format GUID string., xrefs: 00BDA081
Failed to set variable., xrefs: 00BDA1FC
Failed to change value type., xrefs: 00BDA1DD
State, xrefs: 00BDA058
MsiProductSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 00BDA20F
Language, xrefs: 00BDA05F
Failed to enumerate related products for upgrade code., xrefs: 00BDA0B1

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Open@16
String ID: AssignmentType$Failed to change value type.$Failed to copy upgrade code.$Failed to enumerate related products for upgrade code.$Failed to format GUID string.$Failed to get product info.$Failed to set variable.$Language$MsiProductSearch failed: ID '%ls', HRESULT 0x%x$Product or related product not found: %ls$State$Trying per-machine extended info for property '%ls' for product: %ls$Trying per-user extended info for property '%ls' for product: %ls$Unsupported product search type: %u$VersionString
API String ID: 3613110473-2134270738
Opcode ID: 83fdba8eb4440c4f56fd9e9fa15cba0337da409c200ed4451301b1deea910265
Instruction ID: f49ab96c310db1704138b5bec201c2329a04617c91b653add93377543ad1c3ee
Opcode Fuzzy Hash: 83fdba8eb4440c4f56fd9e9fa15cba0337da409c200ed4451301b1deea910265
Instruction Fuzzy Hash: 3C61C572D40115BBCF11AE98D985DEEFBF4EB06714F2041A6F501BA351E232DE40A792

Uniqueness

Uniqueness Score: -1.00%

Function 00BE4AB0 Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 157sleepfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?), ref: 00BE4B0A
GetLastError.KERNEL32 ref: 00BE4B18
Sleep.KERNEL32(00000064), ref: 00BE4B3C

Strings

Failed to verify parent pipe: %ls, xrefs: 00BE4B84
\\.\pipe\%ls, xrefs: 00BE4AC2
Failed to open companion process with PID: %u, xrefs: 00BE4C64
Failed to open parent pipe: %ls, xrefs: 00BE4B62
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 00BE4B55, 00BE4C58
Failed to allocate name of parent pipe., xrefs: 00BE4AD6
\\.\pipe\%ls.Cache, xrefs: 00BE4B9D
Failed to allocate name of parent cache pipe., xrefs: 00BE4BB1
feclient.dll, xrefs: 00BE4B6F, 00BE4C0A, 00BE4C1E, 00BE4C62

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CreateErrorFileLastSleep
String ID: Failed to allocate name of parent cache pipe.$Failed to allocate name of parent pipe.$Failed to open companion process with PID: %u$Failed to open parent pipe: %ls$Failed to verify parent pipe: %ls$\\.\pipe\%ls$\\.\pipe\%ls.Cache$c:\agent\_work\66\s\src\burn\engine\pipe.cpp$feclient.dll
API String ID: 408151869-2029237024
Opcode ID: 16fe29b3e7c76c73a16e1d88a3188e175e07c8f491faac94b5b530fc01565837
Instruction ID: 60277e936f8beb643e66278d7b347cb0c6fa35216c0903fd44d12aad1f638f04
Opcode Fuzzy Hash: 16fe29b3e7c76c73a16e1d88a3188e175e07c8f491faac94b5b530fc01565837
Instruction Fuzzy Hash: ED417C32D42271BBCB2157B19D06F5EBAD4EF05B20F2142A1FE01BB2C1E369DE0096D1

Uniqueness

Uniqueness Score: -1.00%

Function 00BDF52B Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 151registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00BE0478,InstallerVersion,InstallerVersion,00000000,00BE0478,InstallerName,InstallerName,00000000,00BE0478,Date,InstalledDate,00000000,00BE0478,LogonUser), ref: 00BDF6D9

Part of subcall function 00C10D87: RegSetValueExW.ADVAPI32(00020006,00C1FF38,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,00BDF2DF,00000000,?,00020006), ref: 00C10DBA

Strings

InstalledDate, xrefs: 00BDF66A, 00BDF683
PackageName, xrefs: 00BDF5A5, 00BDF5B8
ThisVersionInstalled, xrefs: 00BDF585, 00BDF598
InstallerName, xrefs: 00BDF68A, 00BDF68F, 00BDF690, 00BDF6A0
InstalledBy, xrefs: 00BDF64A, 00BDF663
PublishingGroup, xrefs: 00BDF60D, 00BDF620
LogonUser, xrefs: 00BDF64F
ReleaseType, xrefs: 00BDF630, 00BDF635, 00BDF644
PackageVersion, xrefs: 00BDF5C5, 00BDF5D8
Failed to get the formatted key path for update registration., xrefs: 00BDF54D
Failed to write %ls value., xrefs: 00BDF6C2
Date, xrefs: 00BDF66F
InstallerVersion, xrefs: 00BDF6A7, 00BDF6AC, 00BDF6AD, 00BDF6BD
Publisher, xrefs: 00BDF5E5, 00BDF5F8
Failed to create the key for update registration., xrefs: 00BDF579

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseValue
String ID: Date$Failed to create the key for update registration.$Failed to get the formatted key path for update registration.$Failed to write %ls value.$InstalledBy$InstalledDate$InstallerName$InstallerVersion$LogonUser$PackageName$PackageVersion$Publisher$PublishingGroup$ReleaseType$ThisVersionInstalled
API String ID: 3132538880-2703781546
Opcode ID: b634eb9163d185ea11c899e5fd8bdb4a5ae1e4344af3a9f83a13cd41b70b841f
Instruction ID: 01a810247937d90e02c605a8a10f85f844aaa64697e5ef26a5c10e6758e51ef9
Opcode Fuzzy Hash: b634eb9163d185ea11c899e5fd8bdb4a5ae1e4344af3a9f83a13cd41b70b841f
Instruction Fuzzy Hash: 8241AA31A44636B7CF126A50EC02EBDB9A5AB21710F2941B3FC0276B71E771DE50F694

Uniqueness

Uniqueness Score: -1.00%

Function 00BEE60C Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 134registryCOMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 00BEE652
RegisterClassW.USER32(?), ref: 00BEE67E
GetLastError.KERNEL32 ref: 00BEE689
CreateWindowExW.USER32(00000080,00C291B4,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 00BEE6F0
GetLastError.KERNEL32 ref: 00BEE6FA
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 00BEE798

Strings

Failed to create window., xrefs: 00BEE728
Failed to register window., xrefs: 00BEE6B7
c:\agent\_work\66\s\src\burn\engine\uithread.cpp, xrefs: 00BEE6AD, 00BEE71E
Unexpected return value from message pump., xrefs: 00BEE783
WixBurnMessageWindow, xrefs: 00BEE677, 00BEE793

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$c:\agent\_work\66\s\src\burn\engine\uithread.cpp
API String ID: 213125376-1202977178
Opcode ID: 25b823dea5364aba871a1a8803ac67ee2f3da0d7b5d3cabe791970aa19a7377c
Instruction ID: 78b8d101b7be67a4ed5e9297806ca7f18819ba078d5684bbee4dc2845afff67f
Opcode Fuzzy Hash: 25b823dea5364aba871a1a8803ac67ee2f3da0d7b5d3cabe791970aa19a7377c
Instruction Fuzzy Hash: 4B41A076901265ABDB208BA1DD48BDEBFF8FF09750F1181A5F915BA250E731DD00CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BFC45E Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 271COMMON

Download Yara Rule

Strings

Failed to copy key for passthrough pseudo bundle., xrefs: 00BFC672
Failed to copy filename for passthrough pseudo bundle., xrefs: 00BFC6A8
Failed to allocate space for burn package payload inside of passthrough bundle., xrefs: 00BFC49E
Failed to copy uninstall arguments for passthrough bundle package, xrefs: 00BFC796
Failed to copy related arguments for passthrough bundle package, xrefs: 00BFC76C
Failed to allocate space for burn payload inside of related bundle struct, xrefs: 00BFC6D1
c:\agent\_work\66\s\src\burn\engine\pseudobundle.cpp, xrefs: 00BFC492, 00BFC68B, 00BFC6C5
Failed to copy local source path for passthrough pseudo bundle., xrefs: 00BFC6A1
Failed to copy key for passthrough pseudo bundle payload., xrefs: 00BFC6AF
Failed to recreate command-line arguments., xrefs: 00BFC72D
Failed to copy cache id for passthrough pseudo bundle., xrefs: 00BFC6EF
Failed to allocate memory for pseudo bundle payload hash., xrefs: 00BFC697
Failed to copy download source for passthrough pseudo bundle., xrefs: 00BFC679
Failed to copy install arguments for passthrough bundle package, xrefs: 00BFC74C

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID: Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of passthrough bundle.$Failed to allocate space for burn payload inside of related bundle struct$Failed to copy cache id for passthrough pseudo bundle.$Failed to copy download source for passthrough pseudo bundle.$Failed to copy filename for passthrough pseudo bundle.$Failed to copy install arguments for passthrough bundle package$Failed to copy key for passthrough pseudo bundle payload.$Failed to copy key for passthrough pseudo bundle.$Failed to copy local source path for passthrough pseudo bundle.$Failed to copy related arguments for passthrough bundle package$Failed to copy uninstall arguments for passthrough bundle package$Failed to recreate command-line arguments.$c:\agent\_work\66\s\src\burn\engine\pseudobundle.cpp
API String ID: 1357844191-1911474293
Opcode ID: 85e08898a13cf2e9b38974e465ee4ad45e1dd15a90f1e5a4363dd0b02a1b307c
Instruction ID: 14947fa227e33b617a6e56d15a889edbc7a1fa2cfdc9963cddea709dd94e213d
Opcode Fuzzy Hash: 85e08898a13cf2e9b38974e465ee4ad45e1dd15a90f1e5a4363dd0b02a1b307c
Instruction Fuzzy Hash: 93B17A71A0061AEFDB21DF68C981F65BBE1BF08710F1181AAFE14AB361D771E855DB80

Uniqueness

Uniqueness Score: -1.00%

Function 00BFDAF8 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 203stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,00000000,00000000,?), ref: 00BFDB13

Strings

Failed to create BITS job., xrefs: 00BFDBA2
Failed to create BITS job callback., xrefs: 00BFDC26
Failed to initialize BITS job callback., xrefs: 00BFDC34
Invalid BITS engine URL: %ls, xrefs: 00BFDB35
Failed to complete BITS job., xrefs: 00BFDCBD
Failed to set credentials for BITS job., xrefs: 00BFDBC1
Failed to set callback interface for BITS job., xrefs: 00BFDC4B
Falied to start BITS job., xrefs: 00BFDCCB
Failed to add file to BITS job., xrefs: 00BFDBE0
Failed to download BITS job., xrefs: 00BFDCAA
c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp, xrefs: 00BFDB29, 00BFDC1C
Failed while waiting for BITS download., xrefs: 00BFDCC4
Failed to copy download URL., xrefs: 00BFDB5A

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: lstrlen
String ID: Failed to add file to BITS job.$Failed to complete BITS job.$Failed to copy download URL.$Failed to create BITS job callback.$Failed to create BITS job.$Failed to download BITS job.$Failed to initialize BITS job callback.$Failed to set callback interface for BITS job.$Failed to set credentials for BITS job.$Failed while waiting for BITS download.$Falied to start BITS job.$Invalid BITS engine URL: %ls$c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp
API String ID: 1659193697-397540975
Opcode ID: 5dcedeae8a188e92965f08d869a6b6d2d93834f19795921dba20a244f4c26ce8
Instruction ID: 566e552ea796b8d215237b764cf9f219aaaa5268eedf9cc9a9ecb930b9529ab6
Opcode Fuzzy Hash: 5dcedeae8a188e92965f08d869a6b6d2d93834f19795921dba20a244f4c26ce8
Instruction Fuzzy Hash: E651B636A0022DEBCB119B54C985E7E7BE6EF15710F2281E5FE05AB251D7B0DD04EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BDBC5E Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 189processCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00BDBCB0
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000200,00000000,?,00000044,?,?,?,?,?), ref: 00BDBDBD
GetLastError.KERNEL32(?,?,?,?), ref: 00BDBDC7
WaitForInputIdle.USER32(?,?), ref: 00BDBE1B
CloseHandle.KERNEL32(?,?,?), ref: 00BDBE66
CloseHandle.KERNEL32(?,?,?), ref: 00BDBE73

Strings

"%ls", xrefs: 00BDBD2D, 00BDBD47
"%ls" %s, xrefs: 00BDBCD6, 00BDBD17
Failed to format argument string., xrefs: 00BDBCBB
Failed to create executable command., xrefs: 00BDBCEA
Failed to create obfuscated executable command., xrefs: 00BDBD5B
D, xrefs: 00BDBD9C
c:\agent\_work\66\s\src\burn\engine\approvedexe.cpp, xrefs: 00BDBDEB
Failed to CreateProcess on path: %ls, xrefs: 00BDBDF8
Failed to format obfuscated argument string., xrefs: 00BDBD07

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseHandle$CreateErrorIdleInputLastOpen@16ProcessWait
String ID: "%ls"$"%ls" %s$D$Failed to CreateProcess on path: %ls$Failed to create executable command.$Failed to create obfuscated executable command.$Failed to format argument string.$Failed to format obfuscated argument string.$c:\agent\_work\66\s\src\burn\engine\approvedexe.cpp
API String ID: 155678114-3058035682
Opcode ID: 5b2203931fdfc1e1ae6992040de740c4730b6b7411666a75ce5b8e75e730d5c9
Instruction ID: 4a5708d88a8cb1d5af3fed4ad3901063940f7185ee3a58b50d482416bb885455
Opcode Fuzzy Hash: 5b2203931fdfc1e1ae6992040de740c4730b6b7411666a75ce5b8e75e730d5c9
Instruction Fuzzy Hash: 13513972D0061AFBDF129BA0CD41DEEFBB9FF14700B1545A6EA04B6220F7319E50AB91

Uniqueness

Uniqueness Score: -1.00%

Function 00BF673A Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 152serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,00000000,?,?,?,?,?,?,?,?,00BF6C89,?), ref: 00BF6773
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00BF6C89,?,?,?), ref: 00BF6780
OpenServiceW.ADVAPI32(00000000,wuauserv,00000027,?,?,?,?,?,?,?,?,00BF6C89,?,?,?), ref: 00BF67C8
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00BF6C89,?,?,?), ref: 00BF67D4
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,00BF6C89,?,?,?), ref: 00BF680E
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00BF6C89,?,?,?), ref: 00BF6818
CloseServiceHandle.ADVAPI32(00000000), ref: 00BF68CF
CloseServiceHandle.ADVAPI32(?), ref: 00BF68D9

Strings

Failed to open service control manager., xrefs: 00BF67AE
Failed to open WU service., xrefs: 00BF6802
Failed to query status of WU service., xrefs: 00BF6846
Failed to mark WU service to start on demand., xrefs: 00BF68A0
Failed to read configuration for WU service., xrefs: 00BF687F
c:\agent\_work\66\s\src\burn\engine\msuengine.cpp, xrefs: 00BF67A4, 00BF67F8, 00BF683C
wuauserv, xrefs: 00BF67C2

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Service$ErrorLast$CloseHandleOpen$ManagerQueryStatus
String ID: Failed to mark WU service to start on demand.$Failed to open WU service.$Failed to open service control manager.$Failed to query status of WU service.$Failed to read configuration for WU service.$c:\agent\_work\66\s\src\burn\engine\msuengine.cpp$wuauserv
API String ID: 971853308-110228879
Opcode ID: a0bd3409a0dcd72ad6259c1e98d6cf06b048f1e8007b517868db24826b72e034
Instruction ID: 84f69b43e2b196df06423ef58a0e4c3eb6e7d5aa6e0bb3573bf9878eb9eb1411
Opcode Fuzzy Hash: a0bd3409a0dcd72ad6259c1e98d6cf06b048f1e8007b517868db24826b72e034
Instruction Fuzzy Hash: CD41C836E01229ABD721DBA89D85BBEB7E4AF08750B0141B9FE01F7241E674DC0896A0

Uniqueness

Uniqueness Score: -1.00%

Function 00BDB1D7 Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 137COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,00000000,?,00BDBACA,00000008,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB1DF
GetLastError.KERNEL32(?,00BDBACA,00000008,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00BDB1EB
_memcmp.LIBVCRUNTIME ref: 00BDB293

Strings

Failed to get module handle to process., xrefs: 00BDB219
Failed to read section info, data to short: %u, xrefs: 00BDB2E3
Failed to find valid NT image header in buffer., xrefs: 00BDB277
c:\agent\_work\66\s\src\burn\engine\section.cpp, xrefs: 00BDB20F, 00BDB240, 00BDB26B, 00BDB2D4, 00BDB2F5, 00BDB31E, 00BDB35E
.wix, xrefs: 00BDB2B2
Failed to find Burn section., xrefs: 00BDB301
.wixburn, xrefs: 00BDB28D
Failed to read section info, unsupported version: %08x, xrefs: 00BDB32D
Bundle guid didn't match the guid in the PE Header in memory., xrefs: 00BDB36A
burn, xrefs: 00BDB2BA
Failed to find valid DOS image header in buffer., xrefs: 00BDB24C

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorHandleLastModule_memcmp
String ID: .wix$.wixburn$Bundle guid didn't match the guid in the PE Header in memory.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get module handle to process.$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$burn$c:\agent\_work\66\s\src\burn\engine\section.cpp
API String ID: 3888311042-3868660166
Opcode ID: 71069bc65e527bb3545b8fe55165494c9051bb4251eeb46c996e43e3d1cd62b6
Instruction ID: 97fb6a5a9a0ea1e969a929627aae778960d06f485c7c9ece9daf6fc05d4afcb7
Opcode Fuzzy Hash: 71069bc65e527bb3545b8fe55165494c9051bb4251eeb46c996e43e3d1cd62b6
Instruction Fuzzy Hash: 6F411C32280211E7D72055515C42EAEA6D1AF92B31B2640BBFD036B382F7A9C942E39D

Uniqueness

Uniqueness Score: -1.00%

Function 00BDA249 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 140registryCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00BDA271
RegCloseKey.ADVAPI32(00000000,00000100,00000000,000002C0,?,00000001,00000000,00000000,?,00000000,?,000002C0,000002C0,?,00000000,00000000), ref: 00BDA3C5

Strings

c:\agent\_work\66\s\src\burn\engine\search.cpp, xrefs: 00BDA349
Failed to set variable., xrefs: 00BDA388
Failed to format value string., xrefs: 00BDA2FD
RegistrySearchExists failed: ID '%ls', HRESULT 0x%x, xrefs: 00BDA39D
Failed to format key string., xrefs: 00BDA27C
Registry key not found. Key = '%ls', xrefs: 00BDA2B2
Failed to query registry key value., xrefs: 00BDA353
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 00BDA360
Failed to open registry key. Key = '%ls', xrefs: 00BDA2C6

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseOpen@16
String ID: Failed to format key string.$Failed to format value string.$Failed to open registry key. Key = '%ls'$Failed to query registry key value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchExists failed: ID '%ls', HRESULT 0x%x$c:\agent\_work\66\s\src\burn\engine\search.cpp
API String ID: 1561904661-635686934
Opcode ID: a775ddb1e1257380319e6e83a31b6f8be50ab30b5b62e746f4df0297791b7b41
Instruction ID: 2033487e98393e8c805497788944d66ec9aa0da736d337f8b9d99feeea430bfd
Opcode Fuzzy Hash: a775ddb1e1257380319e6e83a31b6f8be50ab30b5b62e746f4df0297791b7b41
Instruction Fuzzy Hash: BE41C472D40124BBDF129FA4DC02EEEFBE6EF05720F1041A6F805A6292F671DE50A695

Uniqueness

Uniqueness Score: -1.00%

Function 00BD695F Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 132libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,ntdll,?), ref: 00BD69AF
GetLastError.KERNEL32 ref: 00BD69B9
GetProcAddress.KERNEL32(?,RtlGetVersion), ref: 00BD69FC
GetLastError.KERNEL32 ref: 00BD6A06
FreeLibrary.KERNEL32(00000000,00000000,?), ref: 00BD6B17

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00BD69DD, 00BD6A2A
Failed to set variant value., xrefs: 00BD6AFB
Failed to get OS info., xrefs: 00BD6A57
Failed to locate NTDLL., xrefs: 00BD69E7
ntdll, xrefs: 00BD69A9
RtlGetVersion, xrefs: 00BD69F1
Failed to locate RtlGetVersion., xrefs: 00BD6A34

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$AddressFreeHandleLibraryModuleProc
String ID: Failed to get OS info.$Failed to locate NTDLL.$Failed to locate RtlGetVersion.$Failed to set variant value.$RtlGetVersion$c:\agent\_work\66\s\src\burn\engine\variable.cpp$ntdll
API String ID: 3057421322-3993976954
Opcode ID: b58e55668a4b42165d4447846ce7fa3f5d63c353e24bea3d0e7a1e8e3218a718
Instruction ID: 78dab9486415acc7cc499fc39adac65d44b004af7c8d5d3ec38bdef8f46fd5e0
Opcode Fuzzy Hash: b58e55668a4b42165d4447846ce7fa3f5d63c353e24bea3d0e7a1e8e3218a718
Instruction Fuzzy Hash: 8641A272D41239A7DB219B648C45BEEBBE4EB0A710F0041E6F948F6281E7748E84DF90

Uniqueness

Uniqueness Score: -1.00%

Function 00BD4936 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 129memorysynchronizationCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32(?,00000001,00000001,00000000,00000000,?,?,?,00BD54A3,?,?,?,?), ref: 00BD4967
GetLastError.KERNEL32(?,?,?,00BD54A3,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00BD4978
ReleaseMutex.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 00BD4AB5
CloseHandle.KERNEL32(?,?,?,?,00BD54A3,?,?,?,?,?,?,?,?,?,?,?), ref: 00BD4ABE

Strings

Failed to allocate thread local storage for logging., xrefs: 00BD49A6
Failed to create the message window., xrefs: 00BD4A13
Failed to connect to unelevated process., xrefs: 00BD495D
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 00BD499C, 00BD49E5
Failed to set elevated pipe into thread local storage for logging., xrefs: 00BD49EF
comres.dll, xrefs: 00BD4A24
Failed to pump messages from parent process., xrefs: 00BD4A89

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AllocCloseErrorHandleLastMutexRelease
String ID: Failed to allocate thread local storage for logging.$Failed to connect to unelevated process.$Failed to create the message window.$Failed to pump messages from parent process.$Failed to set elevated pipe into thread local storage for logging.$c:\agent\_work\66\s\src\burn\engine\engine.cpp$comres.dll
API String ID: 687263955-55126310
Opcode ID: 29716297ee987bd7e6ad80717f42f107cc3e66dbe45ae3a880f85a6e2a36848e
Instruction ID: a6b7ae082f1664457f1e163e0ab0e3cc044e8cd34c2d63f7b55e5f2b66f5fdb6
Opcode Fuzzy Hash: 29716297ee987bd7e6ad80717f42f107cc3e66dbe45ae3a880f85a6e2a36848e
Instruction Fuzzy Hash: 8441A273941626BBCB169BE08C45FDFF6ECBF05710F0042A7FA05A2241EB74A950A7E5

Uniqueness

Uniqueness Score: -1.00%

Function 00BE3AD7 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 129COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,?,00000000,crypt32.dll), ref: 00BE3B2B
GetLastError.KERNEL32(?,00000000,crypt32.dll), ref: 00BE3B35
GetCurrentProcessId.KERNEL32(?,?,?,00000104,?,?,00000000,crypt32.dll), ref: 00BE3B9E
ProcessIdToSessionId.KERNEL32(00000000,?,00000000,crypt32.dll), ref: 00BE3BA5
CompareStringW.KERNEL32(00000000,00000000,?,?,?,?,?,7FFFFFFF,?,?,?,?,?,00000000,crypt32.dll), ref: 00BE3C2F

Strings

Failed to format session id as a string., xrefs: 00BE3BD3
Failed to copy temp folder., xrefs: 00BE3C58
c:\agent\_work\66\s\src\burn\engine\logging.cpp, xrefs: 00BE3B59
Failed to get length of temp folder., xrefs: 00BE3B8F
Failed to get temp folder., xrefs: 00BE3B63
Failed to get length of session id string., xrefs: 00BE3BFA
%u\, xrefs: 00BE3BBF
crypt32.dll, xrefs: 00BE3AEA

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Process$CompareCurrentErrorLastPathSessionStringTemp
String ID: %u\$Failed to copy temp folder.$Failed to format session id as a string.$Failed to get length of session id string.$Failed to get length of temp folder.$Failed to get temp folder.$c:\agent\_work\66\s\src\burn\engine\logging.cpp$crypt32.dll
API String ID: 2407829081-4120445549
Opcode ID: 7273dd60045b1af2a38aa8879cd337428c83f38497c21d37f228c79545dd8223
Instruction ID: 1338203d99355bc68c5555f954aa90848b8982ca132c556d7772a17c92347f6b
Opcode Fuzzy Hash: 7273dd60045b1af2a38aa8879cd337428c83f38497c21d37f228c79545dd8223
Instruction Fuzzy Hash: 12418272D8127DABCB219B619C4DFD9B7E8EF14B10F2142E1E909B7241E7749F848B90

Uniqueness

Uniqueness Score: -1.00%

Function 00BD7FA2 Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 215COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,?,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000), ref: 00BD7FBF
LeaveCriticalSection.KERNEL32(?), ref: 00BD81E7

Strings

Failed to write included flag., xrefs: 00BD81D5
Failed to write variable value type., xrefs: 00BD81C7
Failed to write variable name., xrefs: 00BD81CE
Failed to write literal flag., xrefs: 00BD81C0
Unsupported variable type., xrefs: 00BD81A4
Failed to write variable value as string., xrefs: 00BD81AB
Failed to write variable value as number., xrefs: 00BD8191
Failed to get version., xrefs: 00BD8198
Failed to get string., xrefs: 00BD81B2
Failed to get numeric., xrefs: 00BD81B9
feclient.dll, xrefs: 00BD809A, 00BD80F0, 00BD8131
Failed to write variable count., xrefs: 00BD7FDA

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get numeric.$Failed to get string.$Failed to get version.$Failed to write included flag.$Failed to write literal flag.$Failed to write variable count.$Failed to write variable name.$Failed to write variable value as number.$Failed to write variable value as string.$Failed to write variable value type.$Unsupported variable type.$feclient.dll
API String ID: 3168844106-2118673349
Opcode ID: 53215cfbe6bd2a98932d8e4e63950a2eb49807e27a9afc3589f284c2c23e1662
Instruction ID: afa39001d46944ead6ab5f2a23bf354ebdf482b98aed656b000aa26ec9b76a63
Opcode Fuzzy Hash: 53215cfbe6bd2a98932d8e4e63950a2eb49807e27a9afc3589f284c2c23e1662
Instruction Fuzzy Hash: DF719032940219EBCF129E64CD81BAEBBE5FB08312F1041A6F90177351EB30DD5AAB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BE9692 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 123fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,?,00000000,?,00BEA724,?,00000000,00000000,00000000,?), ref: 00BE96AD
GetLastError.KERNEL32(?,00BEA724,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00BE96BD

Part of subcall function 00C13933: Sleep.KERNEL32(?,00000000,?,00BE84D1,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,00BD4DFD), ref: 00C1394A

CloseHandle.KERNEL32(00000000,?,00000001,00000003,000007D0,00000000,00000000), ref: 00BE97C9

Strings

Failed to verify payload hash: %ls, xrefs: 00BE9755
Moving, xrefs: 00BE975F
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00BE96E1
%ls payload from working path '%ls' to path '%ls', xrefs: 00BE9774
Failed to verify payload signature: %ls, xrefs: 00BE9718
Failed to copy %ls to %ls, xrefs: 00BE97B7
Failed to open payload in working path: %ls, xrefs: 00BE96EC
Failed to move %ls to %ls, xrefs: 00BE97A1
Copying, xrefs: 00BE9768, 00BE9773

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep
String ID: %ls payload from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open payload in working path: %ls$Failed to verify payload hash: %ls$Failed to verify payload signature: %ls$Moving$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 1275171361-540362316
Opcode ID: 6255a48da25e33aa6af7b96235a666454b181380bb810e2deda2d1cbfd3a9028
Instruction ID: 7420e06a82592d48f10eb90de5de0cd5e4f9db6e7f5d6663f399a86d4f5f0a28
Opcode Fuzzy Hash: 6255a48da25e33aa6af7b96235a666454b181380bb810e2deda2d1cbfd3a9028
Instruction Fuzzy Hash: BE3146729516B07BDB312E129C86FAF3A9CDF41F20F0141A5FD107B682E3618C0896F1

Uniqueness

Uniqueness Score: -1.00%

Function 00BD65DC Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 117COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000), ref: 00BD6618

Part of subcall function 00C1038A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00BD5EE0,00000000), ref: 00C1039E
Part of subcall function 00C1038A: GetProcAddress.KERNEL32(00000000), ref: 00C103A5
Part of subcall function 00C1038A: GetLastError.KERNEL32(?,?,?,00BD5EE0,00000000), ref: 00C103BC

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00BD6644
GetLastError.KERNEL32 ref: 00BD6652
GetSystemWow64DirectoryW.KERNEL32(?,00000104,00000000), ref: 00BD668A
GetLastError.KERNEL32 ref: 00BD6694
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00BD66D7
GetLastError.KERNEL32 ref: 00BD66E1

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00BD6676, 00BD66B8
Failed to set system folder variant value., xrefs: 00BD6740
Failed to get 64-bit system folder., xrefs: 00BD6680
Failed to get 32-bit system folder., xrefs: 00BD66C2
Failed to backslash terminate system folder., xrefs: 00BD6724

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$DirectorySystem$AddressCurrentHandleModuleProcProcessWow64
String ID: Failed to backslash terminate system folder.$Failed to get 32-bit system folder.$Failed to get 64-bit system folder.$Failed to set system folder variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 325818893-3341528362
Opcode ID: 5ed72401a5cfae88f678b20795163f9921ac04513dca9fcd2ccd233cc2cdf326
Instruction ID: ec5723f6832b9821862e381d0d00f3a68ec7729bf18bb046a891db4a09839f62
Opcode Fuzzy Hash: 5ed72401a5cfae88f678b20795163f9921ac04513dca9fcd2ccd233cc2cdf326
Instruction Fuzzy Hash: 08312672D41239A7DB2097548C8DBDEB7E8AB01750F1141E6FD04B7381F678DD848AE1

Uniqueness

Uniqueness Score: -1.00%

Function 00BE3F22 Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 225sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00BE3A2C: RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000000,?,?,?,?,00BE3F3C,feclient.dll,?,00000000,?,?,?,00BD4B57), ref: 00BE3ACD

Sleep.KERNEL32(000007D0,00000001,feclient.dll,?,00000000,?,?,?,00BD4B57,?,?,00C1A488,?,00000001,00000000,00000000), ref: 00BE3FD3

Strings

Failed to copy log extension to extension., xrefs: 00BE411E
clbcatq.dll, xrefs: 00BE4112
Failed to copy full log path to prefix., xrefs: 00BE413C
Setup, xrefs: 00BE3F80
log, xrefs: 00BE3F7A
Failed to copy log path to prefix., xrefs: 00BE40FB
Failed to get non-session specific TEMP folder., xrefs: 00BE4081
crypt32.dll, xrefs: 00BE3F79, 00BE3FDE, 00BE3FE6, 00BE4049, 00BE408B, 00BE40CE, 00BE40ED, 00BE412B, 00BE4155
Failed to get current directory., xrefs: 00BE3FB5
Failed to open log: %ls, xrefs: 00BE404B
feclient.dll, xrefs: 00BE3F36, 00BE3FE3
msasn1.dll, xrefs: 00BE40EF, 00BE4130

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseSleep
String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$clbcatq.dll$crypt32.dll$feclient.dll$log$msasn1.dll
API String ID: 2834455192-2673269691
Opcode ID: 634efec528a820ab3cc14d2844e239387165bd3fbd5eb04d6b8f9d4453886b30
Instruction ID: 7e6f81b4a8d1794e1d83c7b2c0274670bfb0cfb1aba51e07d69155b3bc0e5875
Opcode Fuzzy Hash: 634efec528a820ab3cc14d2844e239387165bd3fbd5eb04d6b8f9d4453886b30
Instruction Fuzzy Hash: 0B61B471A00296BEDF259F75CC46B6A7BE8EF10740B1446B5F801DB281E774EE40D691

Uniqueness

Uniqueness Score: -1.00%

Function 00BD6DCB Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 164COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00BD53FA,00000000,00BD5482,00000000,?,00BD82B1,?,?,?,00000000,00000000), ref: 00BD6DDA

Part of subcall function 00BD56E2: CompareStringW.KERNELBASE(0000007F,00001000,?,000000FF,version.dll,000000FF,?,?,00000000,00BD65B1,00BD65B1,?,00BD5678,?,?,00000000), ref: 00BD571E
Part of subcall function 00BD56E2: GetLastError.KERNEL32(?,00BD5678,?,?,00000000,?,?,00BD65B1,?,00BD7F03,?,?,?,?,?), ref: 00BD574D

LeaveCriticalSection.KERNEL32(00000000,?,?,00000000,00000000,00000000), ref: 00BD6F6A

Strings

Failed to set value of variable: %ls, xrefs: 00BD6F52
c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00BD6E5D
Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 00BD6EDF
Setting numeric variable '%ls' to value %lld, xrefs: 00BD6F0B
Attempt to set built-in variable value: %ls, xrefs: 00BD6E68
Failed to find variable value '%ls'., xrefs: 00BD6DF5
Setting string variable '%ls' to value '%ls', xrefs: 00BD6EFA, 00BD6F02
Unsetting variable '%ls', xrefs: 00BD6EF3, 00BD6F26
Setting hidden variable '%ls', xrefs: 00BD6E98
Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 00BD6F7C
Failed to insert variable '%ls'., xrefs: 00BD6E1F

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalSection$CompareEnterErrorLastLeaveString
String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 2716280545-3393465121
Opcode ID: db006e0f18b42308e679d4a33fa7ad36fb634bdc1d1d3c6dedca00ed65b0c89b
Instruction ID: 070d840eedaa6ad9fba29fbd05392e143b39c4e2b8536d3670d9d26fc3239d4d
Opcode Fuzzy Hash: db006e0f18b42308e679d4a33fa7ad36fb634bdc1d1d3c6dedca00ed65b0c89b
Instruction Fuzzy Hash: 81510871640521EBDB349F14DC8AFABBBE8EB96704F1441AAF84056382E375DD81DAE0

Uniqueness

Uniqueness Score: -1.00%

Function 00C08C92 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00C08CD6

Part of subcall function 00C0880C: _free.LIBCMT ref: 00C08829
Part of subcall function 00C0880C: _free.LIBCMT ref: 00C0883B
Part of subcall function 00C0880C: _free.LIBCMT ref: 00C0884D
Part of subcall function 00C0880C: _free.LIBCMT ref: 00C0885F
Part of subcall function 00C0880C: _free.LIBCMT ref: 00C08871
Part of subcall function 00C0880C: _free.LIBCMT ref: 00C08883
Part of subcall function 00C0880C: _free.LIBCMT ref: 00C08895
Part of subcall function 00C0880C: _free.LIBCMT ref: 00C088A7
Part of subcall function 00C0880C: _free.LIBCMT ref: 00C088B9
Part of subcall function 00C0880C: _free.LIBCMT ref: 00C088CB
Part of subcall function 00C0880C: _free.LIBCMT ref: 00C088DD
Part of subcall function 00C0880C: _free.LIBCMT ref: 00C088EF
Part of subcall function 00C0880C: _free.LIBCMT ref: 00C08901

_free.LIBCMT ref: 00C08CCB

Part of subcall function 00C05CE8: HeapFree.KERNEL32(00000000,00000000,?,00C089A1,?,00000000,?,00000000,?,00C089C8,?,00000007,?,?,00C08E2A,?), ref: 00C05CFE
Part of subcall function 00C05CE8: GetLastError.KERNEL32(?,?,00C089A1,?,00000000,?,00000000,?,00C089C8,?,00000007,?,?,00C08E2A,?,?), ref: 00C05D10

_free.LIBCMT ref: 00C08CED
_free.LIBCMT ref: 00C08D02
_free.LIBCMT ref: 00C08D0D
_free.LIBCMT ref: 00C08D2F
_free.LIBCMT ref: 00C08D42
_free.LIBCMT ref: 00C08D50
_free.LIBCMT ref: 00C08D5B
_free.LIBCMT ref: 00C08D93
_free.LIBCMT ref: 00C08D9A
_free.LIBCMT ref: 00C08DB7
_free.LIBCMT ref: 00C08DCF

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 2b4dad6d8b23714f39494ed39805b21274254eb8f966ea26c8f7573fcfad24e6
Instruction ID: d89453b4a62714bfbf29f6c7c805fc80b14bd9caa0983c150fd358117c00c04e
Opcode Fuzzy Hash: 2b4dad6d8b23714f39494ed39805b21274254eb8f966ea26c8f7573fcfad24e6
Instruction Fuzzy Hash: A5315A31600706AFEF20AA38D945B5B73E9FF14710F20852AE4A9D71D1DF35AE98DB20

Uniqueness

Uniqueness Score: -1.00%

Function 00BE2C15 Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 298COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,006C0064,000000FF,00007070,000000FF,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 00BE2C83

Strings

Failed to allocate registration action., xrefs: 00BE2CEC
Failed to check for remaining dependents during planning., xrefs: 00BE2E29
Failed to add dependents ignored from command-line., xrefs: 00BE2D38
Failed to add self-dependent to ignore dependents., xrefs: 00BE2D07
Failed to add registration action for dependent related bundle., xrefs: 00BE2F85
Failed to add registration action for self dependent., xrefs: 00BE2F50
Failed to create the string dictionary., xrefs: 00BE2CBC
crypt32.dll, xrefs: 00BE2CCE, 00BE2DC8, 00BE2EBD, 00BE2F32
Failed to add dependent bundle provider key to ignore dependents., xrefs: 00BE2DED
wininet.dll, xrefs: 00BE2ED0

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CompareString
String ID: Failed to add dependent bundle provider key to ignore dependents.$Failed to add dependents ignored from command-line.$Failed to add registration action for dependent related bundle.$Failed to add registration action for self dependent.$Failed to add self-dependent to ignore dependents.$Failed to allocate registration action.$Failed to check for remaining dependents during planning.$Failed to create the string dictionary.$crypt32.dll$wininet.dll
API String ID: 1825529933-1705955799
Opcode ID: bda324153cfc72ada223c60b4537301f768ccfcc2c8d84b18b688d68674fb68f
Instruction ID: d0023c1315eb28dd7e0f02c4226ce6138e7c07f78346fe4f10ae5b32ba8d50a7
Opcode Fuzzy Hash: bda324153cfc72ada223c60b4537301f768ccfcc2c8d84b18b688d68674fb68f
Instruction Fuzzy Hash: 62B18930A00266EBCF299F56CC81AAE7BF9FF04710F1481A9F914AA251D770DD91DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00BEF748 Relevance: 19.4, APIs: 4, Strings: 7, Instructions: 186COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00BEF784
UuidCreate.RPCRT4(?), ref: 00BEF867
StringFromGUID2.OLE32(?,?,00000027), ref: 00BEF888
LeaveCriticalSection.KERNEL32(?,?), ref: 00BEF931

Strings

update\%ls, xrefs: 00BEF7E0
Failed to set update bundle., xrefs: 00BEF90B
Failed to convert bundle update guid into string., xrefs: 00BEF8A7
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 00BEF89D
Failed to create bundle update guid., xrefs: 00BEF874
Failed to recreate command-line for update bundle., xrefs: 00BEF84F
Failed to default local update source, xrefs: 00BEF7F4

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalSection$CreateEnterFromLeaveStringUuid
String ID: Failed to convert bundle update guid into string.$Failed to create bundle update guid.$Failed to default local update source$Failed to recreate command-line for update bundle.$Failed to set update bundle.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp$update\%ls
API String ID: 171215650-494903540
Opcode ID: 4ef65e34ca90328c19928206aec068680d45b1eeb8417b3ca08b25decf5db385
Instruction ID: 5134ee3c3ee0f0a0582d16b55884499a537fd8d4930ad159d050bc979bb62dc4
Opcode Fuzzy Hash: 4ef65e34ca90328c19928206aec068680d45b1eeb8417b3ca08b25decf5db385
Instruction Fuzzy Hash: 5451AF35940256EBDF219FA6D845FAEBBF5EF08310F1181B9F909AB252D7319C00CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BD4B2A Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 143windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00BD4CA9
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00BD4CBA

Strings

Failed to check global conditions, xrefs: 00BD4B8E
Failed to create the message window., xrefs: 00BD4BDD
WixBundleLayoutDirectory, xrefs: 00BD4C3A
Failed while running , xrefs: 00BD4C6F
Failed to query registration., xrefs: 00BD4BF3
Failed to set action variables., xrefs: 00BD4C09
Failed to set layout directory variable to value provided from command-line., xrefs: 00BD4C4B
Failed to set registration variables., xrefs: 00BD4C23
Failed to open log., xrefs: 00BD4B5D

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: MessagePostWindow
String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
API String ID: 3618638489-3051724725
Opcode ID: de169c3885ffec55f50a4d41c032f78e7c56d50efcc417c4519bff386ca72838
Instruction ID: b490668c7a7bb1ab93e565d8508b232a6a4c2c79fddf14efe909f5c479e53871
Opcode Fuzzy Hash: de169c3885ffec55f50a4d41c032f78e7c56d50efcc417c4519bff386ca72838
Instruction Fuzzy Hash: 4641E571A02A16BBDB265A60CC85FAAF6ECFF01750F0442A7B815A6350FB70ED5097D1

Uniqueness

Uniqueness Score: -1.00%

Function 00BEEE9A Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00BD39DF: GetProcessHeap.KERNEL32(?,000001C7,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F0
Part of subcall function 00BD39DF: RtlAllocateHeap.NTDLL(00000000,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F7

EnterCriticalSection.KERNEL32(?,00000014,00000001), ref: 00BEEEB7
LeaveCriticalSection.KERNEL32(?), ref: 00BEEFE4

Strings

Failed to post launch approved exe message., xrefs: 00BEEFCF
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 00BEEFC5
Engine is active, cannot change engine state., xrefs: 00BEEED2
Failed to copy the id., xrefs: 00BEEF49
Failed to copy the arguments., xrefs: 00BEEF76
UX requested unknown approved exe with id: %ls, xrefs: 00BEEF17

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalHeapSection$AllocateEnterLeaveProcess
String ID: Engine is active, cannot change engine state.$Failed to copy the arguments.$Failed to copy the id.$Failed to post launch approved exe message.$UX requested unknown approved exe with id: %ls$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 1367039788-2920183924
Opcode ID: 6194291a31746bbb9c67634c8e42e91c1bc7d4eeef5165783cf0fd5d73964611
Instruction ID: 3f284bfaee44ed81f395c490cd0a46c7c71cbf039395a6613ee3fd670e1550bb
Opcode Fuzzy Hash: 6194291a31746bbb9c67634c8e42e91c1bc7d4eeef5165783cf0fd5d73964611
Instruction Fuzzy Hash: D731D032A40265ABEB219B65EC45E9A7BE8EF01720F0581A5FC15EB391E730ED00C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00BE957D Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 102fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,?,00000000,?,00BEA6B7,?,00000000,00000000,00000000,?), ref: 00BE9598
GetLastError.KERNEL32(?,00BEA6B7,?,00000000,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00BE95A6

Part of subcall function 00C13933: Sleep.KERNEL32(?,00000000,?,00BE84D1,?,?,00000001,00000003,000007D0,?,?,?,?,?,?,00BD4DFD), ref: 00C1394A

CloseHandle.KERNEL32(00000000,?,00000001,00000003,000007D0,00000000,00000000), ref: 00BE9684

Strings

Moving, xrefs: 00BE961A
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00BE95CA
Failed to copy %ls to %ls, xrefs: 00BE9672
Failed to move %ls to %ls, xrefs: 00BE965C
%ls container from working path '%ls' to path '%ls', xrefs: 00BE962F
Failed to verify container hash: %ls, xrefs: 00BE9607
Copying, xrefs: 00BE9623, 00BE962E
Failed to open container in working path: %ls, xrefs: 00BE95D5

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLastSleep
String ID: %ls container from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open container in working path: %ls$Failed to verify container hash: %ls$Moving$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 1275171361-3604842143
Opcode ID: b1a319fa5a62568e9a324c5f25f3284a5ad80fb6c8e9e789e3ab4c5fe315f7d3
Instruction ID: 37f25840c40f9141d52cb7ba4d51c02d541444b713d646841e2547bc72fb7b46
Opcode Fuzzy Hash: b1a319fa5a62568e9a324c5f25f3284a5ad80fb6c8e9e789e3ab4c5fe315f7d3
Instruction Fuzzy Hash: 0C2128B2A806B07BDB321A269C46FAF359CDF51F20F014165FD017A2C2D3A59D01D6F5

Uniqueness

Uniqueness Score: -1.00%

Function 00BD6F94 Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 226COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 00BD6FC1
LeaveCriticalSection.KERNEL32(?), ref: 00BD71CD

Strings

Failed to read variable name., xrefs: 00BD71B6
Failed to read variable literal flag., xrefs: 00BD71A8
Failed to read variable value type., xrefs: 00BD71AF
Failed to set variable., xrefs: 00BD71A1
Failed to set variable value., xrefs: 00BD7180
Failed to read variable count., xrefs: 00BD6FE1
Unsupported variable type., xrefs: 00BD7193
Failed to read variable included flag., xrefs: 00BD71BD
Failed to read variable value as number., xrefs: 00BD7187
Failed to read variable value as string., xrefs: 00BD719A

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to read variable count.$Failed to read variable included flag.$Failed to read variable literal flag.$Failed to read variable name.$Failed to read variable value as number.$Failed to read variable value as string.$Failed to read variable value type.$Failed to set variable value.$Failed to set variable.$Unsupported variable type.
API String ID: 3168844106-528957463
Opcode ID: 4b6772bc4642db2c73d550d46614af0166ec5fc8e441fd66e94dcfd56fbdfe57
Instruction ID: 3280517c32f16c67cf47c0c97e307eb1db36c235beebb0679013b4aac1dc368d
Opcode Fuzzy Hash: 4b6772bc4642db2c73d550d46614af0166ec5fc8e441fd66e94dcfd56fbdfe57
Instruction Fuzzy Hash: 7D718171D8511ABBDF119EA4DC45EEEFBF9EF01710F1082A2F900B6290FA719E4597A0

Uniqueness

Uniqueness Score: -1.00%

Function 00C13D01 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 251fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000080,00000000,?,?,00000000,?,00000000,?,?,?), ref: 00C13D7E
GetLastError.KERNEL32 ref: 00C13D94
GetFileSizeEx.KERNEL32(00000000,?), ref: 00C13DE4
GetLastError.KERNEL32 ref: 00C13DEE
SetFilePointer.KERNEL32(00000000,?,?,00000001), ref: 00C13E42
GetLastError.KERNEL32 ref: 00C13E4D
ReadFile.KERNEL32(?,?,?,?,00000000,?,00000000,?,?,00000001), ref: 00C13F3C
CloseHandle.KERNEL32(?), ref: 00C13FAF

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 00C13D21, 00C13DCD, 00C13E0E, 00C13F92

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: File$ErrorLast$CloseCreateHandlePointerReadSize
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 3286166115-1688708105
Opcode ID: 9397cdf19512fd621f9e3116457a49522aa29b91299369b0391fc776195e8069
Instruction ID: 59aa506cdad6aac47f64a90c3db23f5061dc06f611c7d7a65f324a6cb737e30a
Opcode Fuzzy Hash: 9397cdf19512fd621f9e3116457a49522aa29b91299369b0391fc776195e8069
Instruction Fuzzy Hash: 11813A32E00396EBDB218E598C04BEE76E8AF42728F114169FD15EB380D774CF81A791

Uniqueness

Uniqueness Score: -1.00%

Function 00BD3171 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 209COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000040,00000000,00000000), ref: 00BD31BC
GetLastError.KERNEL32 ref: 00BD31C2
ExpandEnvironmentStringsW.KERNEL32(00000040,00000000,00000040,00000000,00000000), ref: 00BD321C
GetLastError.KERNEL32 ref: 00BD3222
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BD32D6
GetLastError.KERNEL32 ref: 00BD32E0
GetFullPathNameW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BD3336
GetLastError.KERNEL32 ref: 00BD3340

Strings

@, xrefs: 00BD3196
c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp, xrefs: 00BD31E6

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$EnvironmentExpandFullNamePathStrings
String ID: @$c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp
API String ID: 1547313835-1835649624
Opcode ID: 621daf7a8355adf22d1ba94ea56bae9c58fe5d0d8fa2fdb88110782ee620ee13
Instruction ID: 7a759394f460587ae877d75cd7326d0acd6894414a8430b8b34de6bd374b0aa7
Opcode Fuzzy Hash: 621daf7a8355adf22d1ba94ea56bae9c58fe5d0d8fa2fdb88110782ee620ee13
Instruction Fuzzy Hash: DE618373D01229ABDB219AD48945B9EFAE4AB04B60F1541E7EE00BB352F735DF0087D6

Uniqueness

Uniqueness Score: -1.00%

Function 00C16527 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 164COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,label,000000FF,?,?,?,74DEDFD0,?,00C16A99,?,?), ref: 00C1657D
SysFreeString.OLEAUT32(00000000), ref: 00C165E8
SysFreeString.OLEAUT32(00000000), ref: 00C16660
SysFreeString.OLEAUT32(00000000), ref: 00C1669F

Strings

`<u, xrefs: 00C165E8, 00C16660, 00C1669F
label, xrefs: 00C1656F
scheme, xrefs: 00C16590
term, xrefs: 00C165B0

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: String$Free$Compare
String ID: `<u$label$scheme$term
API String ID: 1324494773-4028212031
Opcode ID: f94451b4a7a7970572ead0f05449873b4022ea3826a55f8e1dc67f2008317d05
Instruction ID: 90cf65793de0bf092fc0da9d596174a1ce9f3fb46f11c8aef58f6f1d9b36786e
Opcode Fuzzy Hash: f94451b4a7a7970572ead0f05449873b4022ea3826a55f8e1dc67f2008317d05
Instruction Fuzzy Hash: EB514131901119FFCB15DB94C848FEEBBB9AF05715F2082A4F521AB1A0D731AF80EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00BE4D1A Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 121COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 00BE4D4D
StringFromGUID2.OLE32(?,?,00000027), ref: 00BE4D7C
UuidCreate.RPCRT4(?), ref: 00BE4DC7
StringFromGUID2.OLE32(?,?,00000027), ref: 00BE4DF3

Strings

Failed to allocate pipe secret., xrefs: 00BE4E1C
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 00BE4D8D, 00BE4DDA
Failed to create pipe guid., xrefs: 00BE4D5A
BurnPipe.%s, xrefs: 00BE4DA8
Failed to convert pipe guid into string., xrefs: 00BE4D99
Failed to allocate pipe name., xrefs: 00BE4DBC

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CreateFromStringUuid
String ID: BurnPipe.%s$Failed to allocate pipe name.$Failed to allocate pipe secret.$Failed to convert pipe guid into string.$Failed to create pipe guid.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 4041566446-1070039060
Opcode ID: 0f7514e8121af9343de915898b1da4f731e70ae5b35f1c7485379e44705db211
Instruction ID: 6828d5511c936de8aa510ca10801bcf834b15b091ef4034cda8a64c8fce7c67d
Opcode Fuzzy Hash: 0f7514e8121af9343de915898b1da4f731e70ae5b35f1c7485379e44705db211
Instruction Fuzzy Hash: A8418C32E00398ABDB11DBE5DD45EDEB7F8AB54710F208176E805BB250EB789E04CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00BEE8CE Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 100threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,00BD54CB,?,?), ref: 00BEE8EE
GetLastError.KERNEL32(?,00BD54CB,?,?), ref: 00BEE8FB
CreateThread.KERNEL32(00000000,00000000,00BEE60C,?,00000000,00000000), ref: 00BEE954
GetLastError.KERNEL32(?,00BD54CB,?,?), ref: 00BEE961
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,00BD54CB,?,?), ref: 00BEE99C
CloseHandle.KERNEL32(00000000,?,00BD54CB,?,?), ref: 00BEE9BB
CloseHandle.KERNEL32(?,?,00BD54CB,?,?), ref: 00BEE9C8

Strings

c:\agent\_work\66\s\src\burn\engine\uithread.cpp, xrefs: 00BEE91C, 00BEE982
Failed to create the UI thread., xrefs: 00BEE98C
Failed to create initialization event., xrefs: 00BEE926

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create initialization event.$Failed to create the UI thread.$c:\agent\_work\66\s\src\burn\engine\uithread.cpp
API String ID: 2351989216-1290259148
Opcode ID: 64879bb252774c3cf42a5ebdde722ca8dfe8fa8f33b26ca13d8eca01dd0a61b7
Instruction ID: 11ef1d0fa6072c61cb34e906a858b55032c6c626d47712416548c44dcd6be08d
Opcode Fuzzy Hash: 64879bb252774c3cf42a5ebdde722ca8dfe8fa8f33b26ca13d8eca01dd0a61b7
Instruction Fuzzy Hash: 9A31B57AD01226BBD7109F9A9D44BDFBAF8FF08750F1141A5B915F7281E734DE0086A1

Uniqueness

Uniqueness Score: -1.00%

Function 00BEE4A1 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 96threadCOMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,00000000,?,?,00BD54CB,?,?), ref: 00BEE4C2
GetLastError.KERNEL32(?,?,00BD54CB,?,?), ref: 00BEE4CF
CreateThread.KERNEL32(00000000,00000000,00BEE226,00000000,00000000,00000000), ref: 00BEE52E
GetLastError.KERNEL32(?,?,00BD54CB,?,?), ref: 00BEE53B
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,00BD54CB,?,?), ref: 00BEE576
CloseHandle.KERNEL32(?,?,?,00BD54CB,?,?), ref: 00BEE58A
CloseHandle.KERNEL32(?,?,?,00BD54CB,?,?), ref: 00BEE597

Strings

c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp, xrefs: 00BEE4F0, 00BEE55C
Failed to create modal event., xrefs: 00BEE4FA
Failed to create UI thread., xrefs: 00BEE566

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
String ID: Failed to create UI thread.$Failed to create modal event.$c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp
API String ID: 2351989216-1795443032
Opcode ID: ba4d035df81f6c4bed14635bb42fb8bef863962438757fe3acb4c0445c4130c6
Instruction ID: e01e123ac6fed19a5f01f70489d0c46b444219cac5903add180efd2ca9ae6a5e
Opcode Fuzzy Hash: ba4d035df81f6c4bed14635bb42fb8bef863962438757fe3acb4c0445c4130c6
Instruction Fuzzy Hash: D131A876C01225BBD7209B9ADC05A9EBBF4EB49710F0041A6FD15F6250E7348A00CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BF1286 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 87threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,74DF2F60,?,?), ref: 00BF12AA
GetLastError.KERNEL32 ref: 00BF12BD
GetExitCodeThread.KERNEL32(00C1A488,00000000), ref: 00BF12FF
GetLastError.KERNEL32 ref: 00BF130D
ResetEvent.KERNEL32(00C1A460), ref: 00BF1348
GetLastError.KERNEL32 ref: 00BF1352

Strings

Failed to reset operation complete event., xrefs: 00BF1383
Failed to wait for operation complete event., xrefs: 00BF12EE
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00BF12E4, 00BF1334, 00BF1379
Failed to get extraction thread exit code., xrefs: 00BF133E

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2979751695-3513947302
Opcode ID: 1e5c952f1b661b5253bb7bd18c1bceb212c2901f41ad3d2f889bf2aadbcbd13b
Instruction ID: 721a791e4b2fec38aff72cdc2eff6cabb802d53448c6d85efa945cacaf00b82a
Opcode Fuzzy Hash: 1e5c952f1b661b5253bb7bd18c1bceb212c2901f41ad3d2f889bf2aadbcbd13b
Instruction Fuzzy Hash: AF31C570A4031AFBE710DF699D01BBE76E8FF04711F1088A9FA05EB5A1E739DA049B15

Uniqueness

Uniqueness Score: -1.00%

Function 00BF13A0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 82synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00C1A478,?,00000000,?,00BDC198,?,00BD53FA,00000000,?,00BE7740,?,00BD56AA,00BD54B6,00BD54B6,00000000,?), ref: 00BF13BD
GetLastError.KERNEL32(?,00BDC198,?,00BD53FA,00000000,?,00BE7740,?,00BD56AA,00BD54B6,00BD54B6,00000000,?,00BD54C6,FFF9E89D,00BD54C6), ref: 00BF13C7
WaitForSingleObject.KERNEL32(00C1A488,000000FF,?,00BDC198,?,00BD53FA,00000000,?,00BE7740,?,00BD56AA,00BD54B6,00BD54B6,00000000,?,00BD54C6), ref: 00BF1401
GetLastError.KERNEL32(?,00BDC198,?,00BD53FA,00000000,?,00BE7740,?,00BD56AA,00BD54B6,00BD54B6,00000000,?,00BD54C6,FFF9E89D,00BD54C6), ref: 00BF140B
CloseHandle.KERNEL32(00000000,00BD54C6,?,00000000,?,00BDC198,?,00BD53FA,00000000,?,00BE7740,?,00BD56AA,00BD54B6,00BD54B6,00000000), ref: 00BF1456
CloseHandle.KERNEL32(00000000,00BD54C6,?,00000000,?,00BDC198,?,00BD53FA,00000000,?,00BE7740,?,00BD56AA,00BD54B6,00BD54B6,00000000), ref: 00BF1465
CloseHandle.KERNEL32(00000000,00BD54C6,?,00000000,?,00BDC198,?,00BD53FA,00000000,?,00BE7740,?,00BD56AA,00BD54B6,00BD54B6,00000000), ref: 00BF1474

Strings

Failed to wait for thread to terminate., xrefs: 00BF1439
Failed to set begin operation event., xrefs: 00BF13F5
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00BF13EB, 00BF142F

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseHandle$ErrorLast$EventObjectSingleWait
String ID: Failed to set begin operation event.$Failed to wait for thread to terminate.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 1206859064-3195532870
Opcode ID: dd5a484ca6adcea5db806b905879457d6582a03e4113cb74e75a2d1f71182022
Instruction ID: f563ab039bee57489ec24a37505b66b4de9d95eefe7478c1aa0a9ed3ea9d7295
Opcode Fuzzy Hash: dd5a484ca6adcea5db806b905879457d6582a03e4113cb74e75a2d1f71182022
Instruction Fuzzy Hash: 4B212632501A2AF7D3215B29DC05765F6E0FF08721F014A65EA0863E91E379A854DED5

Uniqueness

Uniqueness Score: -1.00%

Function 00BE4177 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 00C0FDEF: EnterCriticalSection.KERNEL32(00C3B5D4,00000000,?,?,?,00BE4192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00BD5537,?), ref: 00C0FDFF
Part of subcall function 00C0FDEF: LeaveCriticalSection.KERNEL32(00C3B5D4,?,?,00C3B5CC,?,00BE4192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00BD5537,?), ref: 00C0FF46

OpenEventLogW.ADVAPI32(00000000,Application), ref: 00BE419D
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00BE41A9
ReportEventW.ADVAPI32(00000000,00000001,00000001,00000001,00000000,00000001,00000000,00C22C44,00000000), ref: 00BE41F6
CloseEventLog.ADVAPI32(00000000), ref: 00BE41FD

Strings

Failed to open Application event log, xrefs: 00BE41D7
Application, xrefs: 00BE4197
Setup, xrefs: 00BE4187
txt, xrefs: 00BE417D
_Failed, xrefs: 00BE4182
c:\agent\_work\66\s\src\burn\engine\logging.cpp, xrefs: 00BE41CD

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Event$CriticalSection$CloseEnterErrorLastLeaveOpenReport
String ID: Application$Failed to open Application event log$Setup$_Failed$c:\agent\_work\66\s\src\burn\engine\logging.cpp$txt
API String ID: 1844635321-1705914837
Opcode ID: ccfcb4c5fab514d115b2ad889115f0c4abff452d45b69b9ef218bfe3dd94c92a
Instruction ID: 493edc6033934219e8cb01e0dbfc5bed793de61e86f122feeaea7adcb96b5f87
Opcode Fuzzy Hash: ccfcb4c5fab514d115b2ad889115f0c4abff452d45b69b9ef218bfe3dd94c92a
Instruction Fuzzy Hash: 94F0D136A422713AA63526237D09EBF1DACEA86F317014168BD01F1581E7588D41C0B2

Uniqueness

Uniqueness Score: -1.00%

Function 00BE92CD Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 232COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,?,00000000,00000000,00000003,00000000,00000000), ref: 00BE9380
GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,000007D0,00000001), ref: 00BE93A8

Strings

Failed to allocate memory, xrefs: 00BE933E
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00BE93C8, 00BE94DC, 00BE952D
Could not verify file %ls., xrefs: 00BE94E9
Could not close verify handle., xrefs: 00BE9537
$, xrefs: 00BE947F
Failed to allocate string., xrefs: 00BE9416
Failed to get file hash., xrefs: 00BE93D2
Failed to encode file hash., xrefs: 00BE9433
0, xrefs: 00BE9440

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast
String ID: $$0$Could not close verify handle.$Could not verify file %ls.$Failed to allocate memory$Failed to allocate string.$Failed to encode file hash.$Failed to get file hash.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 1452528299-3123085469
Opcode ID: 2840927889c2f53b5916d2c69f3c58eca3c1eb56d989cae22fb957e320ea635b
Instruction ID: da607eaad8ecbaf09c1ed4231c6dc862565ee5db89b9f930eac58891a627188f
Opcode Fuzzy Hash: 2840927889c2f53b5916d2c69f3c58eca3c1eb56d989cae22fb957e320ea635b
Instruction Fuzzy Hash: 6D81A472D40269ABDB21DBA5D881BEEB7F4EF08710F110166F910BB381E7349D45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BEE3C8 Relevance: 16.6, APIs: 11, Instructions: 86windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 00BEE3D3
DefWindowProcW.USER32(?,00000082,?,?), ref: 00BEE411
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00BEE41E
SetWindowLongW.USER32(?,000000EB,?), ref: 00BEE42D
DefWindowProcW.USER32(?,?,?,?), ref: 00BEE43B
CreateCompatibleDC.GDI32(?), ref: 00BEE447
SelectObject.GDI32(00000000,00000000), ref: 00BEE458
StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 00BEE47A
SelectObject.GDI32(00000000,00000000), ref: 00BEE482
DeleteDC.GDI32(00000000), ref: 00BEE485
PostQuitMessage.USER32(00000000), ref: 00BEE493

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Window$Long$ObjectProcSelect$CompatibleCreateDeleteMessagePostQuitStretch
String ID:
API String ID: 409979828-0
Opcode ID: 6cc8461f03a2ad9e1f7b0ee8ffecf7fe96de2dab910657ec053beecb96050f11
Instruction ID: 0708a3f250d53986be0321fdac7106c053c2e139a9c3d04be3845a6070812b9d
Opcode Fuzzy Hash: 6cc8461f03a2ad9e1f7b0ee8ffecf7fe96de2dab910657ec053beecb96050f11
Instruction Fuzzy Hash: A9218932100244BFDB159FA99C5CFBE3FB9FB4A320B058558F62A962B0D231C8109B61

Uniqueness

Uniqueness Score: -1.00%

Function 00BEA00C Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 226COMMON

Download Yara Rule

Strings

WixBundleLayoutDirectory, xrefs: 00BEA149
WixBundleLastUsedSource, xrefs: 00BEA075
Failed to copy source path., xrefs: 00BEA1FD
Failed to combine layout source with source., xrefs: 00BEA183
WixBundleOriginalSource, xrefs: 00BEA090
Failed to get current process directory., xrefs: 00BEA0CF
Failed to combine last source with source., xrefs: 00BEA0EE
Failed to get bundle layout directory property., xrefs: 00BEA164

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Find$CloseFileFirstlstrlen
String ID: Failed to combine last source with source.$Failed to combine layout source with source.$Failed to copy source path.$Failed to get bundle layout directory property.$Failed to get current process directory.$WixBundleLastUsedSource$WixBundleLayoutDirectory$WixBundleOriginalSource
API String ID: 2767606509-3003062821
Opcode ID: fd5e8f2f9d4846a05c5e996913b0d79d2c98087910b0477e20b145577f9a3079
Instruction ID: beeea88089dd1f34f1ff1ad3be4ff4d2bad3d70a5e54b37aca31503b8d4f3725
Opcode Fuzzy Hash: fd5e8f2f9d4846a05c5e996913b0d79d2c98087910b0477e20b145577f9a3079
Instruction Fuzzy Hash: 84816D71D00269ABCF11DFA9D981AEEBBF9EF08710F1441AAF911B7250E771AD40CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00BD2EBC Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 202sleepfiletimeCOMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,00000000,00000000,00000000), ref: 00BD2F5C
GetLastError.KERNEL32 ref: 00BD2F66
GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00BD3006
CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 00BD3093
GetLastError.KERNEL32 ref: 00BD30A0
Sleep.KERNEL32(00000064), ref: 00BD30B4
CloseHandle.KERNEL32(?), ref: 00BD311C

Strings

%ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls, xrefs: 00BD3063
c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp, xrefs: 00BD2F8A

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
String ID: %ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp
API String ID: 3480017824-3233915199
Opcode ID: 67224f90e7f8736124080c2a3c285d9a68f6a24e8126cf239600c00f4361ba12
Instruction ID: f0fd99faa4510a419b03e6711fb6c6ba81d532ad8cfd0659c5203948b31f5936
Opcode Fuzzy Hash: 67224f90e7f8736124080c2a3c285d9a68f6a24e8126cf239600c00f4361ba12
Instruction Fuzzy Hash: DD718272D01229ABDB309B64DD89BEDF7F8EB18B10F1041E6B905B7291E7349E818B51

Uniqueness

Uniqueness Score: -1.00%

Function 00BDCB82 Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 143COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,00000001,000000FF,?,00000001,00BD53FA,00000000,00BD54C6,00BD5482,WixBundleUILevel,840F01E8,?,00000001), ref: 00BDCBD9

Strings

c:\agent\_work\66\s\src\burn\engine\payload.cpp, xrefs: 00BDCCDA
Failed to ensure directory exists, xrefs: 00BDCCAB
Payload was not found in container: %ls, xrefs: 00BDCCE6
Failed to get next stream., xrefs: 00BDCCC0
Failed to find embedded payload: %ls, xrefs: 00BDCC05
Failed to extract file., xrefs: 00BDCCA4
Failed to concat file paths., xrefs: 00BDCCB9
Failed to get directory portion of local file path, xrefs: 00BDCCB2

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CompareString
String ID: Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$c:\agent\_work\66\s\src\burn\engine\payload.cpp
API String ID: 1825529933-3317369491
Opcode ID: b58881dd8f3e8c771363a34e07d5bfd185f3d25f22a68273548130976c6f4060
Instruction ID: 2c0ce169289e897ff1d4ed2cb938a0a1e7cd28729ddd1a415a856d9ffe3129d5
Opcode Fuzzy Hash: b58881dd8f3e8c771363a34e07d5bfd185f3d25f22a68273548130976c6f4060
Instruction Fuzzy Hash: 5541C031911216ABCF259F54CD8199EFFE5EF00710B1481EBE919AB352E7709D80EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BD47DF Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 127windowthreadCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 00BD4804
GetCurrentThreadId.KERNEL32 ref: 00BD480A
GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00BD4898

Strings

Failed to start bootstrapper application., xrefs: 00BD4866
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 00BD48E4
Failed to create engine for UX., xrefs: 00BD4824
Unexpected return value from message pump., xrefs: 00BD48EE
Failed to load UX., xrefs: 00BD484D
wininet.dll, xrefs: 00BD4837

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Message$CurrentPeekThread
String ID: Failed to create engine for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$c:\agent\_work\66\s\src\burn\engine\engine.cpp$wininet.dll
API String ID: 673430819-1140212773
Opcode ID: 4e2de4f0be9b0f1e3c754248af01d047daf97826dec7d135f69bdf8d19f35852
Instruction ID: b1409b061348dc396de69d13f3386d460c9fdf3ec93b7812fed1d496e99f76af
Opcode Fuzzy Hash: 4e2de4f0be9b0f1e3c754248af01d047daf97826dec7d135f69bdf8d19f35852
Instruction Fuzzy Hash: 8741BCB1A00615BFEB149BA4CC85EBEB3ECEF05354F1041A6F515E7280EB35ED45ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BF99B4 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 127COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,?,00BFAD39,?,00000001,00000000), ref: 00BF9A3F
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,00BFAD39,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 00BF9A49
CopyFileExW.KERNEL32(00000000,00000000,00BF988D,?,?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 00BF9A97
GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,00BFAD39,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 00BF9AC6

Strings

copy, xrefs: 00BF9A0D
c:\agent\_work\66\s\src\burn\engine\apply.cpp, xrefs: 00BF9A6D, 00BF9AB1, 00BF9AEA
Failed to clear readonly bit on payload destination path: %ls, xrefs: 00BF9A78
Failed attempt to copy payload from: '%ls' to: %ls., xrefs: 00BF9AF8
BA aborted copy of payload from: '%ls' to: %ls., xrefs: 00BF9ABF

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorFileLast$AttributesCopy
String ID: BA aborted copy of payload from: '%ls' to: %ls.$Failed attempt to copy payload from: '%ls' to: %ls.$Failed to clear readonly bit on payload destination path: %ls$c:\agent\_work\66\s\src\burn\engine\apply.cpp$copy
API String ID: 1969131206-3140072123
Opcode ID: 0802e31e96c0b11c43978b469cfb903cf39686052f9efc910bfd70e97b05a572
Instruction ID: 34c1c004372b2cf7d9f8a8590e58edce64deb18955d1529661e00c41d26f48b5
Opcode Fuzzy Hash: 0802e31e96c0b11c43978b469cfb903cf39686052f9efc910bfd70e97b05a572
Instruction Fuzzy Hash: 5B314972A01129A7DB209A558C46FBB77E8EF81B50B1581A9FE05FB241E674CD04D6E0

Uniqueness

Uniqueness Score: -1.00%

Function 00BE8D91 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 125COMMON

Download Yara Rule

APIs

LocalFree.KERNEL32(00000000,?,00000001,80000005,?,00000000,00000000,00000000,00000003,000007D0), ref: 00BE8EDC

Strings

Failed to allocate access for Everyone group to path: %ls, xrefs: 00BE8E26
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00BE8E85
Failed to allocate access for Administrators group to path: %ls, xrefs: 00BE8DE4
Failed to allocate access for SYSTEM group to path: %ls, xrefs: 00BE8E05
Failed to secure cache path: %ls, xrefs: 00BE8EBF
Failed to allocate access for Users group to path: %ls, xrefs: 00BE8E47
Failed to create ACL to secure cache path: %ls, xrefs: 00BE8E90

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: FreeLocal
String ID: Failed to allocate access for Administrators group to path: %ls$Failed to allocate access for Everyone group to path: %ls$Failed to allocate access for SYSTEM group to path: %ls$Failed to allocate access for Users group to path: %ls$Failed to create ACL to secure cache path: %ls$Failed to secure cache path: %ls$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 2826327444-3220527011
Opcode ID: 2e0d2376ad93e6817dc35b03c1cbafe76fe40984826e9dadf73f393f237bcfa3
Instruction ID: 35ef9a43ca8f6abb9e9ed8197a5462c2e49c232a907ea8a21f63b07c8a7d8da9
Opcode Fuzzy Hash: 2e0d2376ad93e6817dc35b03c1cbafe76fe40984826e9dadf73f393f237bcfa3
Instruction Fuzzy Hash: 7631E472E40BA9B7EB3196518D42FBF76E8AB40B10F1141A5BA08BA1C1DFB19D44D7A0

Uniqueness

Uniqueness Score: -1.00%

Function 00C16402 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 113COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,name,000000FF,00000000,00000000,00000000,?,74DEDFD0), ref: 00C16461
CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,email,000000FF), ref: 00C1647E
SysFreeString.OLEAUT32(00000000), ref: 00C164BC
SysFreeString.OLEAUT32(00000000), ref: 00C16500

Strings

name, xrefs: 00C16453
uri, xrefs: 00C1648C
`<u, xrefs: 00C164BC, 00C16500
email, xrefs: 00C16470

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: String$CompareFree
String ID: `<u$email$name$uri
API String ID: 3589242889-1197142144
Opcode ID: 1b165d1e367970ac657191c241152ba24fd1b62b69d1a8ff491791d8f5fac0de
Instruction ID: ecef00272c83be735cc6759a7b2bf26ac7ffd5e8aab9bd051648f332f1440f20
Opcode Fuzzy Hash: 1b165d1e367970ac657191c241152ba24fd1b62b69d1a8ff491791d8f5fac0de
Instruction Fuzzy Hash: 54416C32905219BBCF11DB94CC44FEEB774AF06725F2082A4E921AA2E0C7319E84EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00BDF3F9 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 108stringCOMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00BDF432

Part of subcall function 00BD415F: CreateDirectoryW.KERNELBASE(?,840F01E8,00000000,00000000,?,00BE9FBC,00000000,00000000,?,00000000,00BD53FA,00000000,?,?,00BDD567,?), ref: 00BD416D
Part of subcall function 00BD415F: GetLastError.KERNEL32(?,00BE9FBC,00000000,00000000,?,00000000,00BD53FA,00000000,?,?,00BDD567,?,00000000,00000000), ref: 00BD417B

lstrlenA.KERNEL32(002E0032,00000000,00000094,00000000,00000094,crypt32.dll,crypt32.dll,00BE0458,swidtag,00000094,00C1A500,00330074,00BE0458,00000000,crypt32.dll,00000000), ref: 00BDF485

Part of subcall function 00C145C9: CreateFileW.KERNEL32(002E0032,40000000,00000001,00000000,00000002,00000080,00000000,00BE0458,00000000,?,00BDF49C,00C1A500,00000080,002E0032,00000000), ref: 00C145E1
Part of subcall function 00C145C9: GetLastError.KERNEL32(?,00BDF49C,00C1A500,00000080,002E0032,00000000,?,00BE0458,crypt32.dll,00000094,?,?,?,?,?,00000000), ref: 00C145EE

Strings

Failed to create regid folder: %ls, xrefs: 00BDF4CD
swidtag, xrefs: 00BDF445
Failed to write tag xml to file: %ls, xrefs: 00BDF4C3
Failed to allocate regid file path., xrefs: 00BDF4DD
Failed to allocate regid folder path., xrefs: 00BDF4E4
Failed to format tag folder path., xrefs: 00BDF4EB
crypt32.dll, xrefs: 00BDF422, 00BDF45F, 00BDF460

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CreateErrorLast$DirectoryFileOpen@16lstrlen
String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to create regid folder: %ls$Failed to format tag folder path.$Failed to write tag xml to file: %ls$crypt32.dll$swidtag
API String ID: 904508749-2959304021
Opcode ID: bdc4aec3dc1c4b97569c98cd48fa651006635caf7db499618777b21ef5526f5f
Instruction ID: 07de7f54bd6a42ece10ad044698e4142fa3e01d82f49589b96562a085bb57eb1
Opcode Fuzzy Hash: bdc4aec3dc1c4b97569c98cd48fa651006635caf7db499618777b21ef5526f5f
Instruction Fuzzy Hash: A6315A31D05226FBCB11ABA4EC41BAEFBF5AF14710F1481B7F815AA351E7709E509B90

Uniqueness

Uniqueness Score: -1.00%

Function 00BEE10F Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103windowCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(?,00000001), ref: 00BEE145
GetLastError.KERNEL32 ref: 00BEE151
GetObjectW.GDI32(00000000,00000018,?), ref: 00BEE198
GetCursorPos.USER32(?), ref: 00BEE1B9
MonitorFromPoint.USER32(?,?,00000002), ref: 00BEE1CB
GetMonitorInfoW.USER32(00000000,?), ref: 00BEE1E1

Strings

c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp, xrefs: 00BEE175
(, xrefs: 00BEE1D8
Failed to load splash screen bitmap., xrefs: 00BEE17F

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Monitor$BitmapCursorErrorFromInfoLastLoadObjectPoint
String ID: ($Failed to load splash screen bitmap.$c:\agent\_work\66\s\src\burn\engine\splashscreen.cpp
API String ID: 2342928100-3540601290
Opcode ID: 38c676a4a9a4a023020f6b2e0251b8300774d373da99b7c65d7e674f038026ed
Instruction ID: b5c32b0b70a2366f7030ecfc2739f02780c4d3365647895b9074851f94668d28
Opcode Fuzzy Hash: 38c676a4a9a4a023020f6b2e0251b8300774d373da99b7c65d7e674f038026ed
Instruction Fuzzy Hash: CC317E71A01215AFDB10CFA9D945B9EBBF5FF08710F118169F914EB281EB30E904CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BE5053 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 83COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32(?,00000000,?,?,00C1A500), ref: 00BE505C
GetProcessId.KERNEL32(000000FF,?,?,open,00000000,00000000,?,000000FF,?,?), ref: 00BE50FA
CloseHandle.KERNEL32(00000000), ref: 00BE5113

Strings

-q -%ls %ls %ls %u, xrefs: 00BE5081
Failed to allocate parameters for elevated process., xrefs: 00BE5095
runas, xrefs: 00BE50BA
Failed to launch elevated child process: %ls, xrefs: 00BE50E7
open, xrefs: 00BE50C4, 00BE50D2
burn.elevated, xrefs: 00BE507C

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Process$CloseCurrentHandle
String ID: -q -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to launch elevated child process: %ls$burn.elevated$open$runas
API String ID: 2815245435-1352204306
Opcode ID: 603dc173f10f9916670145eb45ab28423585229376f3274fbe501e4a1222db0f
Instruction ID: 6518f146bb17c2dab0e99f8810e28b8c82594b62509e67763925884bd857bfaa
Opcode Fuzzy Hash: 603dc173f10f9916670145eb45ab28423585229376f3274fbe501e4a1222db0f
Instruction Fuzzy Hash: 4D218DB1900659FFCF119F95DC819AEBBB8FF05318B1080AAF801A2211D7359F50EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00BD6898 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(msi,DllGetVersion), ref: 00BD68C2
GetProcAddress.KERNEL32(00000000), ref: 00BD68C9
GetLastError.KERNEL32 ref: 00BD68D3

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00BD68F7
Failed to get msi.dll version info., xrefs: 00BD691B
Failed to find DllGetVersion entry point in msi.dll., xrefs: 00BD6901
Failed to set variant value., xrefs: 00BD693F
DllGetVersion, xrefs: 00BD68B4
msi, xrefs: 00BD68B9

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: DllGetVersion$Failed to find DllGetVersion entry point in msi.dll.$Failed to get msi.dll version info.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp$msi
API String ID: 4275029093-3573271201
Opcode ID: d7bb3c5df2ff50222f9fc527f52d4a6fb1add0b1aeaadebcdeece8524f341d01
Instruction ID: c8bd21cb458a9b228c799e1a1a50c9429c158263f6e858653da09880428d06b5
Opcode Fuzzy Hash: d7bb3c5df2ff50222f9fc527f52d4a6fb1add0b1aeaadebcdeece8524f341d01
Instruction Fuzzy Hash: 3411D672A4163667E710A7689C91BFFB7E4EB09B10B11016AFE01F7381E638DD4496A1

Uniqueness

Uniqueness Score: -1.00%

Function 00BDD679 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,00000000,00000008,00000000,?,00BD4847,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00BD54CB,?), ref: 00BDD68A
GetLastError.KERNEL32(?,00BD4847,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00BD54CB,?,?), ref: 00BDD697
GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 00BDD6CF
GetLastError.KERNEL32(?,00BD4847,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00BD54CB,?,?), ref: 00BDD6DB

Strings

Failed to get BootstrapperApplicationCreate entry-point, xrefs: 00BDD706
Failed to load UX DLL., xrefs: 00BDD6C2
Failed to create UX., xrefs: 00BDD71F
c:\agent\_work\66\s\src\burn\engine\userexperience.cpp, xrefs: 00BDD6B8, 00BDD6FC
BootstrapperApplicationCreate, xrefs: 00BDD6C9

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$c:\agent\_work\66\s\src\burn\engine\userexperience.cpp
API String ID: 1866314245-3967977479
Opcode ID: bf5efb5f4527fea1d7812676107c1629673561936f50f270b4db8af16090f817
Instruction ID: 4bcddc835d1b7ff99844a593fb1c3246f8bfdaf1d9f2a7db7d14707cdef85d1c
Opcode Fuzzy Hash: bf5efb5f4527fea1d7812676107c1629673561936f50f270b4db8af16090f817
Instruction Fuzzy Hash: 70112E37681B31B7D72116549C05F9FAAD4AB06B61F0141BBFE45F7381F515DC0056D0

Uniqueness

Uniqueness Score: -1.00%

Function 00BD1173 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 52libraryloadermemoryCOMMON

Download Yara Rule

APIs

HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,00BD111A,cabinet.dll,00000009,?,?,00000000), ref: 00BD1184
GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,00BD111A,cabinet.dll,00000009,?,?,00000000), ref: 00BD118F
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 00BD119D
GetLastError.KERNEL32(?,?,?,?,?,00BD111A,cabinet.dll,00000009,?,?,00000000), ref: 00BD11B8
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 00BD11C0
GetLastError.KERNEL32(?,?,?,?,?,00BD111A,cabinet.dll,00000009,?,?,00000000), ref: 00BD11D5

Strings

SetDefaultDllDirectories, xrefs: 00BD1197
SetDllDirectoryW, xrefs: 00BD11BA
kernel32, xrefs: 00BD118A

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AddressErrorLastProc$HandleHeapInformationModule
String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
API String ID: 3104334766-1824683568
Opcode ID: f3957a2b16d29be9893f13ff1f7d2250991bb2b8dbc0c0433f52e7b914c3dee5
Instruction ID: 280ad3545463f7653d517ad289aced5be0462032d8f17866017e0a1fef003adf
Opcode Fuzzy Hash: f3957a2b16d29be9893f13ff1f7d2250991bb2b8dbc0c0433f52e7b914c3dee5
Instruction Fuzzy Hash: 550188712022167B97116B6A9C05FEFBBADFF467617008062F90AB1141F670DA459BB2

Uniqueness

Uniqueness Score: -1.00%

Function 00BEF47A Relevance: 15.2, APIs: 2, Strings: 8, Instructions: 154COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00BEF48F
LeaveCriticalSection.KERNEL32(?), ref: 00BEF60A

Strings

UX did not provide container or payload id., xrefs: 00BEF5F9
UX requested unknown payload with id: %ls, xrefs: 00BEF4E4
UX denied while trying to set download URL on embedded payload: %ls, xrefs: 00BEF4FA
UX requested unknown container with id: %ls, xrefs: 00BEF534
Engine is active, cannot change engine state., xrefs: 00BEF4A9
Failed to set download password., xrefs: 00BEF5B8
Failed to set download user., xrefs: 00BEF592
Failed to set download URL., xrefs: 00BEF569

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set download URL.$Failed to set download password.$Failed to set download user.$UX denied while trying to set download URL on embedded payload: %ls$UX did not provide container or payload id.$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-2615595102
Opcode ID: 4675ccf32bd15a4ab25fb5f7825c4857bf325e60c2d0159dd56cdaef1fc897a3
Instruction ID: 88c66aa5fcedd49ba111aec074067c888bae6849456ad370a96f7e7b938e2eec
Opcode Fuzzy Hash: 4675ccf32bd15a4ab25fb5f7825c4857bf325e60c2d0159dd56cdaef1fc897a3
Instruction Fuzzy Hash: 2C41C772A00293ABCB219F66D846A7AB7E8EF31710F2581F6F805A7291E774DD40D790

Uniqueness

Uniqueness Score: -1.00%

Function 00C05835 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00C05849

Part of subcall function 00C05CE8: HeapFree.KERNEL32(00000000,00000000,?,00C089A1,?,00000000,?,00000000,?,00C089C8,?,00000007,?,?,00C08E2A,?), ref: 00C05CFE
Part of subcall function 00C05CE8: GetLastError.KERNEL32(?,?,00C089A1,?,00000000,?,00000000,?,00C089C8,?,00000007,?,?,00C08E2A,?,?), ref: 00C05D10

_free.LIBCMT ref: 00C05855
_free.LIBCMT ref: 00C05860
_free.LIBCMT ref: 00C0586B
_free.LIBCMT ref: 00C05876
_free.LIBCMT ref: 00C05881
_free.LIBCMT ref: 00C0588C
_free.LIBCMT ref: 00C05897
_free.LIBCMT ref: 00C058A2
_free.LIBCMT ref: 00C058B0

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 36f3e06ebbb4a7729dd3e295902f1351d3dac9fdddd2f9eb291478dc6a6f58e1
Instruction ID: 9d57a8aedeb8384f2067563c8dd35b8efec9c6d7b79d8293820ff95cabd6e6df
Opcode Fuzzy Hash: 36f3e06ebbb4a7729dd3e295902f1351d3dac9fdddd2f9eb291478dc6a6f58e1
Instruction Fuzzy Hash: 7B118976610608BFDB41EF54C942CDE3BA5FF09350BA141A5FA085F2A2DA31DE50EF80

Uniqueness

Uniqueness Score: -1.00%

Function 00C15253 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 195filememoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(000000FF,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,00000000,00000000,00000078,00000410,000000FF,?,00000000,00000000), ref: 00C15290
GetLastError.KERNEL32 ref: 00C1529E
VirtualAlloc.KERNEL32(00000000,00010000,00003000,00000004), ref: 00C152DF
GetLastError.KERNEL32 ref: 00C152EC
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00C1545F
CloseHandle.KERNEL32(?), ref: 00C1546E

Strings

c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp, xrefs: 00C152C2
GET, xrefs: 00C15393

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLastVirtual$AllocCloseCreateFileFreeHandle
String ID: GET$c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp
API String ID: 2028584396-547604341
Opcode ID: 6586ba9f5813f7e7aa1aec91ac67d1697ad84d5a57f5e888b04dd0d1cd067183
Instruction ID: 6caac58197ad34c6e528e0ef176db1bed266bd44527855947a261f8e700d69a4
Opcode Fuzzy Hash: 6586ba9f5813f7e7aa1aec91ac67d1697ad84d5a57f5e888b04dd0d1cd067183
Instruction Fuzzy Hash: 46619D72A00A1AEBDB11CFA4CC44BEE7BB8BF89351F114119FD25B7250D7B4D980AB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BE0BE7 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 00BE0FB3: CompareStringW.KERNEL32(00000000,00000000,feclient.dll,000000FF,00000000,000000FF,00000000,00000000,?,?,00BE0C06,?,00000000,?,00000000,00000000), ref: 00BE0FE2

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,00000000,?,00000000,00000001,?,?,00000000,?,00000000), ref: 00BE0D8A
GetLastError.KERNEL32 ref: 00BE0D97

Strings

c:\agent\_work\66\s\src\burn\engine\plan.cpp, xrefs: 00BE0DBB
Failed to append package start action., xrefs: 00BE0C2C
Failed to append payload cache action., xrefs: 00BE0D41
Failed to append cache action., xrefs: 00BE0CE1
Failed to create syncpoint event., xrefs: 00BE0DC5
Failed to append rollback cache action., xrefs: 00BE0C66

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CompareCreateErrorEventLastString
String ID: Failed to append cache action.$Failed to append package start action.$Failed to append payload cache action.$Failed to append rollback cache action.$Failed to create syncpoint event.$c:\agent\_work\66\s\src\burn\engine\plan.cpp
API String ID: 801187047-574661624
Opcode ID: 44eeae57861a9333e814f57f2e147912dcf48203146cca43746ebba7b363c8ce
Instruction ID: 4d4fac84163116b8cf2da5cd42abae1f9f835658ec18056c6459cf874dec1ef6
Opcode Fuzzy Hash: 44eeae57861a9333e814f57f2e147912dcf48203146cca43746ebba7b363c8ce
Instruction Fuzzy Hash: F3618F75510645EFCB05EF59C980AAEBBF9FF84310F2184AAEC059B302EB71E981DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C166D4 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 158COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,74DEDFD0,000000FF,type,000000FF,?,74DEDFD0,74DEDFD0,74DEDFD0), ref: 00C1672A
SysFreeString.OLEAUT32(00000000), ref: 00C16775
SysFreeString.OLEAUT32(00000000), ref: 00C167F1
SysFreeString.OLEAUT32(00000000), ref: 00C1683D

Strings

url, xrefs: 00C1673D
`<u, xrefs: 00C16775, 00C167F1, 00C1683D
type, xrefs: 00C1671C

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: String$Free$Compare
String ID: `<u$type$url
API String ID: 1324494773-1686489133
Opcode ID: 6d3a46ad26772cd24b66e5d14b5f4e891dd5bd575b9ba0cf2fc47c9db7fedb74
Instruction ID: c43c7d9b0f17db3dc13488229c8357964a7bbdff1014a09f50aceda0f993a640
Opcode Fuzzy Hash: 6d3a46ad26772cd24b66e5d14b5f4e891dd5bd575b9ba0cf2fc47c9db7fedb74
Instruction Fuzzy Hash: CA511E35901119FFDB15DB94C888FEEBBB8AF05715F1481A9E821AB1A1D731DF80EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00BD9E89 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 146COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00BD9EAF
_MREFOpen@16.MSPDB140-MSVCRT ref: 00BD9ED4

Strings

Failed to get component path: %d, xrefs: 00BD9F38
Failed to set variable., xrefs: 00BD9FB8
Failed to format product code string., xrefs: 00BD9EDF
Failed to format component id string., xrefs: 00BD9EBA
MsiComponentSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 00BD9FC8

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Open@16
String ID: Failed to format component id string.$Failed to format product code string.$Failed to get component path: %d$Failed to set variable.$MsiComponentSearch failed: ID '%ls', HRESULT 0x%x
API String ID: 3613110473-1671347822
Opcode ID: 6b8db1995c3706c5c509a2878fb5ec2de7a2f28c2948b45e7c82fa8a50c54754
Instruction ID: a38efa993eec7e481fb01ea8b260404f089c0ba5a0ad4829108dc0e609a6a2ba
Opcode Fuzzy Hash: 6b8db1995c3706c5c509a2878fb5ec2de7a2f28c2948b45e7c82fa8a50c54754
Instruction Fuzzy Hash: 0941F572904215BBCB259B688C82BBEF7E9EF01310F2446E7F110E2391F731A990E791

Uniqueness

Uniqueness Score: -1.00%

Function 00BE48B9 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 116fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(00000000,00000001,00000008,?,00000000,?,00000000,00000000,00000001,00000000,?,?,?,00000000,crypt32.dll,00000000), ref: 00BE48E4
GetLastError.KERNEL32 ref: 00BE48F1
ReadFile.KERNEL32(?,00000000,?,?,00000000,?,00000000), ref: 00BE499C
GetLastError.KERNEL32 ref: 00BE49A6

Strings

Failed to allocate data for message., xrefs: 00BE495A
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 00BE4950, 00BE4967, 00BE49CA
Failed to read data for message., xrefs: 00BE49D4
Failed to read message from pipe., xrefs: 00BE4971

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorFileLastRead
String ID: Failed to allocate data for message.$Failed to read data for message.$Failed to read message from pipe.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 1948546556-3469126999
Opcode ID: 9c25d4492ef2714dc899416e622500a8c4769091f14c561927212f0e417f8dbb
Instruction ID: 83f332657857a1e1f390fb7b3a266c45874d91541dd123ca26cd025adf96cc7e
Opcode Fuzzy Hash: 9c25d4492ef2714dc899416e622500a8c4769091f14c561927212f0e417f8dbb
Instruction Fuzzy Hash: C5310636A0026ABFD710DAA2DC45BAFF6E8EF04751F1181B5BD41B6282E7789E0087D1

Uniqueness

Uniqueness Score: -1.00%

Function 00BE5365 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 90synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,0002BF20,?,F0000003,00000000,00000000,?,00000000,00000000,00000000,00BD54CB,00000000,00000000,?,00000000), ref: 00BE540E
GetLastError.KERNEL32(?,?,?,00BD4CA6,?,?,00000000,?,?,?,?,?,?,00C1A4A0,?,?), ref: 00BE5419

Strings

Failed to write restart to message buffer., xrefs: 00BE53B1
Failed to post terminate message to child process., xrefs: 00BE53F9
Failed to write exit code to message buffer., xrefs: 00BE5389
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 00BE543D
Failed to post terminate message to child process cache thread., xrefs: 00BE53DD
Failed to wait for child process exit., xrefs: 00BE5447

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: Failed to post terminate message to child process cache thread.$Failed to post terminate message to child process.$Failed to wait for child process exit.$Failed to write exit code to message buffer.$Failed to write restart to message buffer.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 1211598281-389050287
Opcode ID: 65a842a8bc14e89d333e47534b93ee1e18a6df61fae51911a7375b0fc4ea54ae
Instruction ID: 9092770b66626b722db64270e4db430ccbf114e1bbf26c8e3ff97bb268eefdb5
Opcode Fuzzy Hash: 65a842a8bc14e89d333e47534b93ee1e18a6df61fae51911a7375b0fc4ea54ae
Instruction Fuzzy Hash: 7F212B33900A69BBCB325A51DC01E9EB7F9EF00369F1042A6F900BA2D1D774AE8096D5

Uniqueness

Uniqueness Score: -1.00%

Function 00BE8F6B Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 89fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000101,?,00BE9DDA,00000003,000007D0,00000003,?,000007D0), ref: 00BE8F85
GetLastError.KERNEL32(?,00BE9DDA,00000003,000007D0,00000003,?,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001,?), ref: 00BE8F92
CloseHandle.KERNEL32(00000000,?,00BE9DDA,00000003,000007D0,00000003,?,000007D0,?,000007D0,00000000,00000003,00000000,00000003,000007D0,00000001), ref: 00BE905A

Strings

c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00BE8FC9
Failed to open payload at path: %ls, xrefs: 00BE8FD6
Failed to verify hash of payload: %ls, xrefs: 00BE9045
Failed to verify catalog signature of payload: %ls, xrefs: 00BE9021
Failed to verify signature of payload: %ls, xrefs: 00BE9002

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: Failed to open payload at path: %ls$Failed to verify catalog signature of payload: %ls$Failed to verify hash of payload: %ls$Failed to verify signature of payload: %ls$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 2528220319-1480445316
Opcode ID: f0455b467d8ee270a46031d71979b215b1f087615b09ebbd34dd6d301176f3f3
Instruction ID: ddaaab9fde99f46c2a2676004f5cae4c3ea2e6575704844c873a1808bdda090c
Opcode Fuzzy Hash: f0455b467d8ee270a46031d71979b215b1f087615b09ebbd34dd6d301176f3f3
Instruction Fuzzy Hash: 8C217432940675FBCB321A66EC44FAA3BA9FF00B70F0082A1FD0025692E3359D64DAD1

Uniqueness

Uniqueness Score: -1.00%

Function 00BD6B30 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00BD6B7B
GetLastError.KERNEL32 ref: 00BD6B85
GetVolumePathNameW.KERNEL32(?,?,00000104), ref: 00BD6BC9
GetLastError.KERNEL32 ref: 00BD6BD3

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00BD6BA9, 00BD6BF7
Failed to set variant value., xrefs: 00BD6C1D
Failed to get volume path name., xrefs: 00BD6C01
Failed to get windows directory., xrefs: 00BD6BB3

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$DirectoryNamePathVolumeWindows
String ID: Failed to get volume path name.$Failed to get windows directory.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 124030351-26183806
Opcode ID: 5db42e8aaf1788f619e0462ecbf2d74c5519d35e40d712c72211d8c9fb4208c7
Instruction ID: f9c883502695a7bb38bf74aa6b8b8b896d70cba2f3c06784aea9c32af3ca3cce
Opcode Fuzzy Hash: 5db42e8aaf1788f619e0462ecbf2d74c5519d35e40d712c72211d8c9fb4208c7
Instruction Fuzzy Hash: 3721F672E4123967D720A6589D06FDEB7ECEB05B10F1141F6BE04F7282FA389D4486A5

Uniqueness

Uniqueness Score: -1.00%

Function 00BD9C2D Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 82COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00BD9C46
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,?,00BDA86A,00000100,000002C0,000002C0,?,000002C0,00000100), ref: 00BD9C5E
GetLastError.KERNEL32(?,00BDA86A,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 00BD9C6B

Strings

c:\agent\_work\66\s\src\burn\engine\search.cpp, xrefs: 00BD9C9B
Failed to set variable., xrefs: 00BD9CF4
File search: %ls, did not find path: %ls, xrefs: 00BD9CBD
Failed get to file attributes. '%ls', xrefs: 00BD9CA8
Failed to format variable string., xrefs: 00BD9C51

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed get to file attributes. '%ls'$Failed to format variable string.$Failed to set variable.$File search: %ls, did not find path: %ls$c:\agent\_work\66\s\src\burn\engine\search.cpp
API String ID: 1811509786-3902182656
Opcode ID: 4dcbd65befe0002b45ca94b536c2e26cb96a26ab6b24bf52f012d81594aab25e
Instruction ID: c1f4f3492231fe99b129337a01a9788fcae2a56f29258075b5352801cb540c03
Opcode Fuzzy Hash: 4dcbd65befe0002b45ca94b536c2e26cb96a26ab6b24bf52f012d81594aab25e
Instruction Fuzzy Hash: DB213432910121BBEB216AA49C06B9EFAE5EF01720F1582B6FD01A6391FA719D40A6D1

Uniqueness

Uniqueness Score: -1.00%

Function 00BEAC12 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

TlsSetValue.KERNEL32(?,?), ref: 00BEAC29
GetLastError.KERNEL32 ref: 00BEAC33
CoInitializeEx.OLE32(00000000,00000000), ref: 00BEAC72
CoUninitialize.OLE32(?,00BEC5CA,?,?), ref: 00BEACAF

Strings

Failed to pump messages in child process., xrefs: 00BEAC9D
Failed to initialize COM., xrefs: 00BEAC7E
Failed to set elevated cache pipe into thread local storage for logging., xrefs: 00BEAC61
c:\agent\_work\66\s\src\burn\engine\elevation.cpp, xrefs: 00BEAC57

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorInitializeLastUninitializeValue
String ID: Failed to initialize COM.$Failed to pump messages in child process.$Failed to set elevated cache pipe into thread local storage for logging.$c:\agent\_work\66\s\src\burn\engine\elevation.cpp
API String ID: 876858697-588708458
Opcode ID: 119d0f1995d15253dc04bae6a8faabe451e41cac4b72574aeab6f25ffc351f59
Instruction ID: 4d300e03d8be44947f77f408844cbbac2f656afcb3a376e3480327e0ef8759d0
Opcode Fuzzy Hash: 119d0f1995d15253dc04bae6a8faabe451e41cac4b72574aeab6f25ffc351f59
Instruction Fuzzy Hash: 161106739411717B872157629C0AE9FBEECFF05B20B2282A5FC01B7350E760BD4096D6

Uniqueness

Uniqueness Score: -1.00%

Function 00BD5D14 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 53registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00BD5D9A

Part of subcall function 00C1095E: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00C109D4
Part of subcall function 00C1095E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00C10A0C

Strings

ProgramFilesDir, xrefs: 00BD5D29
Failed to read folder path for '%ls'., xrefs: 00BD5D66
Failed to ensure path was backslash terminated., xrefs: 00BD5D84
SOFTWARE\Microsoft\Windows\CurrentVersion, xrefs: 00BD5D37
+, xrefs: 00BD5D1C
CommonFilesDir, xrefs: 00BD5D22, 00BD5D56, 00BD5D65
Failed to open Windows folder key., xrefs: 00BD5D4C

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: QueryValue$Close
String ID: +$CommonFilesDir$Failed to ensure path was backslash terminated.$Failed to open Windows folder key.$Failed to read folder path for '%ls'.$ProgramFilesDir$SOFTWARE\Microsoft\Windows\CurrentVersion
API String ID: 1979452859-3209209246
Opcode ID: 16a350139d27a02f65f56f7799d7984308ab0ec6ff9f49e6fef732aa09ba78e7
Instruction ID: ebd95a7056d7f0f40bdb5039029dc3aadd87e68ab174a10efdf2d9862cafd94d
Opcode Fuzzy Hash: 16a350139d27a02f65f56f7799d7984308ab0ec6ff9f49e6fef732aa09ba78e7
Instruction Fuzzy Hash: 4501F932940524B7CF315A54EC56EDEBAA9DB12760F108076F804B6351E6708E80F5E4

Uniqueness

Uniqueness Score: -1.00%

Function 00BF9FA3 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 173COMMON

Download Yara Rule

APIs

SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,?,00000000,00000000,?), ref: 00BFA070
GetLastError.KERNEL32(?,?,?,00000000,00000000,?), ref: 00BFA07A

Strings

Failed attempt to download URL: '%ls' to: '%ls', xrefs: 00BFA157
c:\agent\_work\66\s\src\burn\engine\apply.cpp, xrefs: 00BFA09E
:, xrefs: 00BFA0F3
Failed to clear readonly bit on payload destination path: %ls, xrefs: 00BFA0A9
download, xrefs: 00BFA03A

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: :$Failed attempt to download URL: '%ls' to: '%ls'$Failed to clear readonly bit on payload destination path: %ls$c:\agent\_work\66\s\src\burn\engine\apply.cpp$download
API String ID: 1799206407-2514864748
Opcode ID: f73f888a18ac55cdd400dcfb0cf43f917adf8cb826d4ee5b81f99a28cb05e12c
Instruction ID: a693bce751fdf9f4e574ca92e3374a70f0f239f5afec6a690c2c476dcdc26e78
Opcode Fuzzy Hash: f73f888a18ac55cdd400dcfb0cf43f917adf8cb826d4ee5b81f99a28cb05e12c
Instruction Fuzzy Hash: 3251A3B1A00219ABDB25DFA4C841AFEB7F9FF05710F108499EA05FB241E775DA48CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C17C88 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 157COMMON

Download Yara Rule

APIs

Part of subcall function 00BD39DF: GetProcessHeap.KERNEL32(?,000001C7,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F0
Part of subcall function 00BD39DF: RtlAllocateHeap.NTDLL(00000000,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F7

CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000010,00000001,00000000,00000000,00000410,?,?,00BF8D9E,000002C0,00000100), ref: 00C17CB6
CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF,?,?,00BF8D9E,000002C0,00000100,000002C0,000002C0,00000100,000002C0,00000410), ref: 00C17CD1

Strings

application, xrefs: 00C17CC3
http://appsyndication.org/2006/appsyn, xrefs: 00C17CA9
type, xrefs: 00C17CF8
c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp, xrefs: 00C17D6C

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CompareHeapString$AllocateProcess
String ID: application$c:\agent\_work\66\s\src\libs\dutil\apuputil.cpp$http://appsyndication.org/2006/appsyn$type
API String ID: 2664528157-536847345
Opcode ID: b73e4e5b8cd9d68b231228ebf9c4d293947a496f52207c28f28460ff478d9166
Instruction ID: ee1551dd7c45883a5fdb534b374719de6500f8aef8603d84f119dab2f02af296
Opcode Fuzzy Hash: b73e4e5b8cd9d68b231228ebf9c4d293947a496f52207c28f28460ff478d9166
Instruction Fuzzy Hash: 8151B331648305AFDB209F54CC81FAA77F5AF02720F208659F9259B2D5D774EE80EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C15C9E Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 153fileCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00C15CFA
DeleteFileW.KERNEL32(00000410,00000000,00000000,?,?,00000078,000000FF,00000410,?,?,?,00000078,000000FF,?,?,00000078), ref: 00C15DF1
CloseHandle.KERNEL32(000000FF,00000000,00000000,?,?,00000078,000000FF,00000410,?,?,?,00000078,000000FF,?,?,00000078), ref: 00C15E00

Strings

c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp, xrefs: 00C15D1E
DownloadTimeout, xrefs: 00C15D33
WiX\Burn, xrefs: 00C15D38
Burn, xrefs: 00C15CE9

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseDeleteErrorFileHandleLast
String ID: Burn$DownloadTimeout$WiX\Burn$c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp
API String ID: 3522763407-1474791565
Opcode ID: 2fb25120971f81298478a4eb8080a820dbd8be040a496408911ac962622d2476
Instruction ID: 87919949afe97eba040e0ab26cd8cce8bbf473c1402484fe2d7e3bf917731d2f
Opcode Fuzzy Hash: 2fb25120971f81298478a4eb8080a820dbd8be040a496408911ac962622d2476
Instruction Fuzzy Hash: D1516972D00619FBDB12DFA4CD45EEFBBB9EF49710F014166FA10E6150E7358A50ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BE9158 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

_memcmp.LIBVCRUNTIME ref: 00BE91E6

Part of subcall function 00C14ED0: GetLastError.KERNEL32(?,?,00BE920B,?,00000003,00BD54C6,?), ref: 00C14EEF

_memcmp.LIBVCRUNTIME ref: 00BE9220
GetLastError.KERNEL32 ref: 00BE9298

Strings

Failed to read certificate thumbprint., xrefs: 00BE928C
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00BE92BC
Failed to find expected public key in certificate chain., xrefs: 00BE925B
Failed to get certificate public key identifier., xrefs: 00BE92C6

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast_memcmp
String ID: Failed to find expected public key in certificate chain.$Failed to get certificate public key identifier.$Failed to read certificate thumbprint.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 3428363238-3038490147
Opcode ID: a4057fab4c1d0b64dbe2e6a370402e18a83d9cb6775a1fa343aae1c91b8c9244
Instruction ID: 31497cce56fd00ada46a29ecd7e07c9d70f293570ad98247cb76040976d6ed2f
Opcode Fuzzy Hash: a4057fab4c1d0b64dbe2e6a370402e18a83d9cb6775a1fa343aae1c91b8c9244
Instruction Fuzzy Hash: CA413D72E0021AABDF10DBA5D841EAEB7F8EF08710F1541A5EA05F7641D774ED488BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00BE0539 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 132registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,00000001,00000000,?), ref: 00BE066A
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,00000001,00000000,?), ref: 00BE0679

Part of subcall function 00C104A5: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,00BE05B1,?,00000000,00020006), ref: 00C104CA

Strings

Failed to open registration key., xrefs: 00BE06AF
Failed to update resume mode., xrefs: 00BE064E
Failed to delete registration key: %ls, xrefs: 00BE0618
Failed to write volatile reboot required registry key., xrefs: 00BE05B5
%ls.RebootRequired, xrefs: 00BE0587

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Close$Create
String ID: %ls.RebootRequired$Failed to delete registration key: %ls$Failed to open registration key.$Failed to update resume mode.$Failed to write volatile reboot required registry key.
API String ID: 359002179-2517785395
Opcode ID: bc9814fef514e7e4a87f9e9ca81bb10044d00efbd6d23d7f9be6328f4aadab88
Instruction ID: 401d3795cea4595e6179f321ad27ea17fcdb6ed770443d3d8afa0ac4fa6e6c38
Opcode Fuzzy Hash: bc9814fef514e7e4a87f9e9ca81bb10044d00efbd6d23d7f9be6328f4aadab88
Instruction Fuzzy Hash: E3417F31910254FFDF22AFA1DC42EAFB7F5EF90710F1044AAF54161152E7B19A90DA51

Uniqueness

Uniqueness Score: -1.00%

Function 00BDF7B4 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 00BDF8E4
RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 00BDF8F1

Strings

Failed to open registration key., xrefs: 00BDF84D
Failed to format pending restart registry key to read., xrefs: 00BDF7E8
Failed to read Resume value., xrefs: 00BDF87A
%ls.RebootRequired, xrefs: 00BDF7D1
Resume, xrefs: 00BDF858

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Close
String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
API String ID: 3535843008-3890505273
Opcode ID: 8c3fe2a4fca8cddafcc717d6fcd2913b02d0288ade62f3cec24634ba42f15fff
Instruction ID: d68c54f59aa18d6cfd0f6562dd8ecf5e1ee26b99fc225b96f20fab34e4417c08
Opcode Fuzzy Hash: 8c3fe2a4fca8cddafcc717d6fcd2913b02d0288ade62f3cec24634ba42f15fff
Instruction Fuzzy Hash: 6A414D3190811AEFDB119F94D980ABDFBE4FF04310F2181B7E816AB351E3729E40AB52

Uniqueness

Uniqueness Score: -1.00%

Function 00BF3727 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 111COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00BF378E

Strings

Failed to format property string part., xrefs: 00BF3809
Failed to escape string., xrefs: 00BF3810
Failed to format property value., xrefs: 00BF3817
Failed to append property string part., xrefs: 00BF3802
%s%="%s", xrefs: 00BF37C1
feclient.dll, xrefs: 00BF3769, 00BF378A

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Open@16
String ID: %s%="%s"$Failed to append property string part.$Failed to escape string.$Failed to format property string part.$Failed to format property value.$feclient.dll
API String ID: 3613110473-656185529
Opcode ID: 734f520274fd69b5ae293a16cb63bd4b9dced01910f433ca3abb800604f565b4
Instruction ID: c1e4cc03a6319c57824416121d0717f2e129fa05417b1b762ad517be7ce90827
Opcode Fuzzy Hash: 734f520274fd69b5ae293a16cb63bd4b9dced01910f433ca3abb800604f565b4
Instruction Fuzzy Hash: 9F31AEB1D04229ABCF15AF54DC41EAEBBF8EF00B50F1041AAFA0167251E775AF18DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BEA8DD Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 110COMMON

Download Yara Rule

Strings

Failed to determine length of relative path., xrefs: 00BEA92A
WixBundleLastUsedSource, xrefs: 00BEA97C, 00BEA982, 00BEA9BE
Failed to trim source folder., xrefs: 00BEA972
Failed to determine length of source path., xrefs: 00BEA90D
Failed to set last source., xrefs: 00BEA9CD

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID:
String ID: Failed to determine length of relative path.$Failed to determine length of source path.$Failed to set last source.$Failed to trim source folder.$WixBundleLastUsedSource
API String ID: 0-660234312
Opcode ID: 35610a54d7496bba0b582d5ae65faa522050a506859a743d01b3dd4b46483476
Instruction ID: 920e7e114dd0267057ae194991028eb5c8a390f1bbade3d9e9911a2353bac745
Opcode Fuzzy Hash: 35610a54d7496bba0b582d5ae65faa522050a506859a743d01b3dd4b46483476
Instruction Fuzzy Hash: 3F31EA36D40265BBCF229A95CC41EAEBBFDEB41730F2242A2F410BA2D1D730AD419691

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD572 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 105comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00C301A0,00000000,00000017,00C301B0,?,?,00000000,00000000,?,?,?,?,?,00BFDB99,00000000,00000000), ref: 00BFD5AA

Strings

WixBurn, xrefs: 00BFD5D5
Failed to create BITS job., xrefs: 00BFD5E4
Failed to set notification flags for BITS job., xrefs: 00BFD5FC
Failed to create IBackgroundCopyManager., xrefs: 00BFD5B6
Failed to set BITS job to foreground., xrefs: 00BFD62B
Failed to set progress timeout., xrefs: 00BFD614

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CreateInstance
String ID: Failed to create BITS job.$Failed to create IBackgroundCopyManager.$Failed to set BITS job to foreground.$Failed to set notification flags for BITS job.$Failed to set progress timeout.$WixBurn
API String ID: 542301482-468763447
Opcode ID: 1b6c6fa7eb54555f68bec8935a39fbb008dd54938ed93e92714e4527481d449c
Instruction ID: 98e4a79468edb788ba9d49b87a7199535f35ed70a251688da99cc61d5e4afcca
Opcode Fuzzy Hash: 1b6c6fa7eb54555f68bec8935a39fbb008dd54938ed93e92714e4527481d449c
Instruction Fuzzy Hash: CF31A532A40219AFDB15CB68C895EBFBBF5EF49714B1041A9EA05EB350C670EC05CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C1559F Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 99fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,?,?,?,?,?,WiX\Burn,DownloadTimeout,00000078), ref: 00C155E9
GetLastError.KERNEL32 ref: 00C155F6
ReadFile.KERNEL32(00000000,00000008,00000008,?,00000000), ref: 00C1563D
GetLastError.KERNEL32 ref: 00C15671
CloseHandle.KERNEL32(00000000,c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp,000000C8,00000000), ref: 00C156A5

Strings

c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp, xrefs: 00C1561A, 00C15695
%ls.R, xrefs: 00C155BD

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleRead
String ID: %ls.R$c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp
API String ID: 3160720760-260802336
Opcode ID: 92d2ca95d548400118f535243b9a743b61a49a660802eb8b471bb1c6c9cce6b5
Instruction ID: 8f4a06ec87527eb8c3cf9708252fed8004e55ab3ca152c171e6b3b1e9d497d42
Opcode Fuzzy Hash: 92d2ca95d548400118f535243b9a743b61a49a660802eb8b471bb1c6c9cce6b5
Instruction Fuzzy Hash: D2313772941620EBE7208B54CD44BEE7AA4AF87720F124255FE11EB3C0D3749D80ABE1

Uniqueness

Uniqueness Score: -1.00%

Function 00BDC8A5 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 97fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00BDCD19: CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,00BDE3ED,000000FF,00000000,00000000,00BDE3ED,?,?,00BDDB97,?,?,?,?), ref: 00BDCD44

CreateFileW.KERNEL32(E900C1AA,80000000,00000005,00000000,00000003,08000000,00000000,00BD5402,?,00000000,840F01E8,E0680A79,00000001,00BD53FA,00000000,00BD54C6), ref: 00BDC915
GetLastError.KERNEL32(?,?,?,00BE76FC,00BD56AA,00BD54B6,00BD54B6,00000000,?,00BD54C6,FFF9E89D,00BD54C6,00BD54FA,00BD5482,?,00BD5482), ref: 00BDC95A

Strings

Failed to find payload for catalog file., xrefs: 00BDC99F
Failed to open catalog in working path: %ls, xrefs: 00BDC988
c:\agent\_work\66\s\src\burn\engine\catalog.cpp, xrefs: 00BDC97B
Failed to verify catalog signature: %ls, xrefs: 00BDC953
Failed to get catalog local file path, xrefs: 00BDC998

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CompareCreateErrorFileLastString
String ID: Failed to find payload for catalog file.$Failed to get catalog local file path$Failed to open catalog in working path: %ls$Failed to verify catalog signature: %ls$c:\agent\_work\66\s\src\burn\engine\catalog.cpp
API String ID: 1774366664-749786727
Opcode ID: c14170742d3830b22903f1438a85e4f71e113034cd0ae0e651a0555b58339e61
Instruction ID: 7e69d6b5705c96ae63a2200edae9ca1ffd33524db3ddcdb7512daf1a461f5bde
Opcode Fuzzy Hash: c14170742d3830b22903f1438a85e4f71e113034cd0ae0e651a0555b58339e61
Instruction Fuzzy Hash: 2D31C632900622BFD7119B54CC51F99FFE4AF05750F2182A6B905EB381F675A940DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C10201 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 91processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 00C10271
GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 00C1027B
CloseHandle.KERNEL32(?,?,?,?,?,00000000,00000000,00000000), ref: 00C102C4
CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 00C102D1

Strings

"%ls" %ls, xrefs: 00C1023A
D, xrefs: 00C10259
c:\agent\_work\66\s\src\libs\dutil\procutil.cpp, xrefs: 00C1029F

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseHandle$CreateErrorLastProcess
String ID: "%ls" %ls$D$c:\agent\_work\66\s\src\libs\dutil\procutil.cpp
API String ID: 161867955-1799623275
Opcode ID: e8c6352248ce2ce4cb66950f6967a42b5b2ef569e71f909ea42e5290b02c5c27
Instruction ID: 2df3558e3574094590b17c3c1f81e561d3dd9a6c03476b12dc144b64d6070040
Opcode Fuzzy Hash: e8c6352248ce2ce4cb66950f6967a42b5b2ef569e71f909ea42e5290b02c5c27
Instruction Fuzzy Hash: 75216171D0121AEBDB11DFD4DD49AEEBBB8BF05710F204026EA01B7211E6B08E8096A1

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD016 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,74DF30B0,00000000,?,?,?,00BFD312,?), ref: 00BFD035
ReleaseMutex.KERNEL32(?,?,?,00BFD312,?), ref: 00BFD049
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BFD08E
ReleaseMutex.KERNEL32(?), ref: 00BFD0A1
SetEvent.KERNEL32(?), ref: 00BFD0AA

Strings

Failed to get message from netfx chainer., xrefs: 00BFD0CB
Failed to send files in use message from netfx chainer., xrefs: 00BFD0EE

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: MutexObjectReleaseSingleWait$Event
String ID: Failed to get message from netfx chainer.$Failed to send files in use message from netfx chainer.
API String ID: 2608678126-3424578679
Opcode ID: 844579dc5e575d070a1970ba08dcc448cf81db717e3d275a455c53fbbebcd5e9
Instruction ID: 34966a6c1526a15c8800b243e1b808eb77e8d48995576b25c215e4a56f9db24a
Opcode Fuzzy Hash: 844579dc5e575d070a1970ba08dcc448cf81db717e3d275a455c53fbbebcd5e9
Instruction Fuzzy Hash: 7031B13290021EBFCB019B64DC55FFEBBF9BF05320F1082A6F510A3291CB74A9559B90

Uniqueness

Uniqueness Score: -1.00%

Function 00BD9B5C Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00BD9B75
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,?,00BDA880,00000100,000002C0,000002C0,00000100), ref: 00BD9B95
GetLastError.KERNEL32(?,00BDA880,00000100,000002C0,000002C0,00000100), ref: 00BD9BA0

Strings

Failed while searching directory search: %ls, for path: %ls, xrefs: 00BD9BF6
Failed to set directory search path variable., xrefs: 00BD9BD1
Directory search: %ls, did not find path: %ls, reason: 0x%x, xrefs: 00BD9C0C
Failed to format variable string., xrefs: 00BD9B80

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Directory search: %ls, did not find path: %ls, reason: 0x%x$Failed to format variable string.$Failed to set directory search path variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-2966038646
Opcode ID: 22b4de3b00a74bd3568724d919fcc24e3dd8f62df0df44620d080961f1f770e7
Instruction ID: 8816a2bc6d64d619cba90300e496a94f31c5373f22fd77d8d297a0f239b23f28
Opcode Fuzzy Hash: 22b4de3b00a74bd3568724d919fcc24e3dd8f62df0df44620d080961f1f770e7
Instruction Fuzzy Hash: 2B11F632C40125B7DB221A98AD02F9DFAA5EF01720F2542A3F805762A1F7259D90F6D5

Uniqueness

Uniqueness Score: -1.00%

Function 00BD9D11 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 71COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00BD9D2A
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,?,00BDA858,00000100,000002C0,000002C0,?,000002C0,00000100), ref: 00BD9D4A
GetLastError.KERNEL32(?,00BDA858,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 00BD9D55

Strings

File search: %ls, did not find path: %ls, xrefs: 00BD9DB9
Failed while searching file search: %ls, for path: %ls, xrefs: 00BD9D83
Failed to set variable to file search path., xrefs: 00BD9DAD
Failed to format variable string., xrefs: 00BD9D35

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable to file search path.$Failed while searching file search: %ls, for path: %ls$File search: %ls, did not find path: %ls
API String ID: 1811509786-3425311760
Opcode ID: 9ba5eecedda03e55700bfcaa0caee205460b9abb6dc209f8c279241ea5f422f4
Instruction ID: 98445a8da15bd2c81cb5ddb9b05ee950fcdb3a0fa9722f3149482ebf6cc6002b
Opcode Fuzzy Hash: 9ba5eecedda03e55700bfcaa0caee205460b9abb6dc209f8c279241ea5f422f4
Instruction Fuzzy Hash: C011D236940125FBDF226A94DD02B9DFAA6EF16720F2041B2FC11762A1F7319E50B6C1

Uniqueness

Uniqueness Score: -1.00%

Function 00BECDC8 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 54synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000493E0,00000000,?,?,00BED1EC,00000000,?,?,00BEC672,?,?,?,?,?,00BD54A3), ref: 00BECDDA
GetLastError.KERNEL32(?,?,00BED1EC,00000000,?,?,00BEC672,?,?,?,?,?,00BD54A3,?,?,?), ref: 00BECDE4
GetExitCodeThread.KERNEL32(?,?,?,?,00BED1EC,00000000,?,?,00BEC672,?,?,?,?,?,00BD54A3,?), ref: 00BECE20
GetLastError.KERNEL32(?,?,00BED1EC,00000000,?,?,00BEC672,?,?,?,?,?,00BD54A3,?,?,?), ref: 00BECE2A

Strings

Failed to get cache thread exit code., xrefs: 00BECE58
c:\agent\_work\66\s\src\burn\engine\elevation.cpp, xrefs: 00BECE08, 00BECE4E
Failed to wait for cache thread to terminate., xrefs: 00BECE12

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$c:\agent\_work\66\s\src\burn\engine\elevation.cpp
API String ID: 3686190907-1009398494
Opcode ID: 54898aa0552c7d9e1cf99b67ae2ebbade78c8c39b8e8600840da19a728f3a4b0
Instruction ID: 3f31442e5f7c8aee1aae03cc05c17fa5574770609d9fc38129ca1182faa0086d
Opcode Fuzzy Hash: 54898aa0552c7d9e1cf99b67ae2ebbade78c8c39b8e8600840da19a728f3a4b0
Instruction Fuzzy Hash: DC014573A4163163D6205795AD06B8F7DD8BF05B90B0280B1BE01BA181E769ED0182E5

Uniqueness

Uniqueness Score: -1.00%

Function 00BE68AE Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 53synchronizationthreadCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000001,000000FF,00000000,?,00BE6DE9,?,?,00000000,crypt32.dll,00000000,00000001), ref: 00BE68BB
GetLastError.KERNEL32(?,00BE6DE9,?,?,00000000,crypt32.dll,00000000,00000001), ref: 00BE68C5
GetExitCodeThread.KERNEL32(00000001,00000000,?,00BE6DE9,?,?,00000000,crypt32.dll,00000000,00000001), ref: 00BE6904
GetLastError.KERNEL32(?,00BE6DE9,?,?,00000000,crypt32.dll,00000000,00000001), ref: 00BE690E

Strings

Failed to get cache thread exit code., xrefs: 00BE693F
c:\agent\_work\66\s\src\burn\engine\core.cpp, xrefs: 00BE68EC, 00BE6935
Failed to wait for cache thread to terminate., xrefs: 00BE68F6

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectSingleThreadWait
String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$c:\agent\_work\66\s\src\burn\engine\core.cpp
API String ID: 3686190907-4004332966
Opcode ID: 4e5c578186e871b62fa6a249066ee9b4e7c74221e8134df70d692dbd0ff13f40
Instruction ID: 72e9a742ddbf91dacb712ece46bfdca95cfc58eeb059b5937d0bcf632f8cb3d3
Opcode Fuzzy Hash: 4e5c578186e871b62fa6a249066ee9b4e7c74221e8134df70d692dbd0ff13f40
Instruction Fuzzy Hash: 09118870740256FBE7009F65AE02B6E7BE8EF14790F1080A5B904E51A1EB7ACA40A725

Uniqueness

Uniqueness Score: -1.00%

Function 00BEAA79 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 131COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00BD54C6,000000FF,00BD5482,00BE76FC,00BD53FA,00000000,?), ref: 00BEAB6A
GetLastError.KERNEL32(00000000,00000000,00000000,00000000,00BD54C6,000000FF,00BD5482,00BE76FC,00BD53FA,00000000,?), ref: 00BEABAE

Part of subcall function 00BE9158: _memcmp.LIBVCRUNTIME ref: 00BE91E6
Part of subcall function 00BE9158: _memcmp.LIBVCRUNTIME ref: 00BE9220

Strings

Failed authenticode verification of payload: %ls, xrefs: 00BEAB4B
Failed to get provider state from authenticode certificate., xrefs: 00BEAB98
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00BEAB40, 00BEAB8E, 00BEABD2
0, xrefs: 00BEAAE6
Failed to verify expected payload against actual certificate chain., xrefs: 00BEABF2
Failed to get signer chain from authenticode certificate., xrefs: 00BEABDC

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast_memcmp
String ID: 0$Failed authenticode verification of payload: %ls$Failed to get provider state from authenticode certificate.$Failed to get signer chain from authenticode certificate.$Failed to verify expected payload against actual certificate chain.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 3428363238-3510382728
Opcode ID: 09c713fdd098c13d3c8debe0c7c206467d5572f6df810d9599dcd07c5d51838a
Instruction ID: 4f0b183b48fc80b477c0913c87d2ecc075b41e3956480d4a01370f393d9c0d97
Opcode Fuzzy Hash: 09c713fdd098c13d3c8debe0c7c206467d5572f6df810d9599dcd07c5d51838a
Instruction Fuzzy Hash: 7241E4B2C01269ABDB10DBA5DC45ADFBAF8EF04710F110169F901B7381E774AD408BE5

Uniqueness

Uniqueness Score: -1.00%

Function 00BEF618 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 117COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00BEF62D
LeaveCriticalSection.KERNEL32(?), ref: 00BEF73A

Strings

UX requested unknown payload with id: %ls, xrefs: 00BEF699
Failed to set source path for container., xrefs: 00BEF71F
UX requested unknown container with id: %ls, xrefs: 00BEF6F9
UX denied while trying to set source on embedded payload: %ls, xrefs: 00BEF6AF
Engine is active, cannot change engine state., xrefs: 00BEF647
Failed to set source path for payload., xrefs: 00BEF6C9

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Engine is active, cannot change engine state.$Failed to set source path for container.$Failed to set source path for payload.$UX denied while trying to set source on embedded payload: %ls$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
API String ID: 3168844106-4121889706
Opcode ID: b533db08d9078ec6faf9f512b9998ef7913b67a3c08e99b866337afaaad9a2ad
Instruction ID: b2f07bc395dbfa31bd90d4274a4b3bf663ec907d75713b697a11c5613258c0c2
Opcode Fuzzy Hash: b533db08d9078ec6faf9f512b9998ef7913b67a3c08e99b866337afaaad9a2ad
Instruction Fuzzy Hash: C7310572A002A2BB8B219B65DC45E6AB7E8DF51760B1581F6F804E7340E770ED00C790

Uniqueness

Uniqueness Score: -1.00%

Function 00BD720A Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 98stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 00BD721D

Strings

Failed to append escape sequence., xrefs: 00BD72B0
[\%c], xrefs: 00BD727C
Failed to append characters., xrefs: 00BD72A9
[]{}, xrefs: 00BD7247
Failed to copy string., xrefs: 00BD72D1
Failed to format escape sequence., xrefs: 00BD72B7
Failed to allocate buffer for escaped string., xrefs: 00BD7234

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: lstrlen
String ID: Failed to allocate buffer for escaped string.$Failed to append characters.$Failed to append escape sequence.$Failed to copy string.$Failed to format escape sequence.$[\%c]$[]{}
API String ID: 1659193697-3250950999
Opcode ID: 25c7eb88c94def752f4f461462ab8176a227b92db03f9cba35e30629f1fdd838
Instruction ID: 3f1e1da6761ec9440b096f10f24069a07543fa0e739d3832f069b98ec3ec168f
Opcode Fuzzy Hash: 25c7eb88c94def752f4f461462ab8176a227b92db03f9cba35e30629f1fdd838
Instruction Fuzzy Hash: 9221B932D89295FADB2197949C82FEEF6E8DB12764F2001A7F80076341FF749E44E694

Uniqueness

Uniqueness Score: -1.00%

Function 00BF5954 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 206COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,00C1A500,000000FF,feclient.dll,000000FF,00000000,00000000,?,?,?,00BF6548,?,00000001,?,00000000), ref: 00BF59BD

Strings

Failed to copy target product code., xrefs: 00BF5AEE
Failed to insert execute action., xrefs: 00BF5A12
Failed grow array of ordered patches., xrefs: 00BF5A56
Failed to plan action for target product., xrefs: 00BF5A68
feclient.dll, xrefs: 00BF59B3, 00BF5ADB

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CompareString
String ID: Failed grow array of ordered patches.$Failed to copy target product code.$Failed to insert execute action.$Failed to plan action for target product.$feclient.dll
API String ID: 1825529933-3477540455
Opcode ID: 6289d7285f59940c3f31b708f6d2e402bb0c4fec6c8719f4874836841d144e24
Instruction ID: b0f8be08acebc515ad90aeec7b8ff4bfe756ecef86f4c89954ceb0c057db96d2
Opcode Fuzzy Hash: 6289d7285f59940c3f31b708f6d2e402bb0c4fec6c8719f4874836841d144e24
Instruction Fuzzy Hash: FF8126B560065ADFCB28CF58C880AAA77E5FF08324F1186A9EE159B352D770EC65CF50

Uniqueness

Uniqueness Score: -1.00%

Function 00C0C3AD Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,00C0CB22,00000000,00000000,00000000,00000000,00000000,00C02718), ref: 00C0C3EF
__fassign.LIBCMT ref: 00C0C46A
__fassign.LIBCMT ref: 00C0C485
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 00C0C4AB
WriteFile.KERNEL32(?,00000000,00000000,00C0CB22,00000000,?,?,?,?,?,?,?,?,?,00C0CB22,00000000), ref: 00C0C4CA
WriteFile.KERNEL32(?,00000000,00000001,00C0CB22,00000000,?,?,?,?,?,?,?,?,?,00C0CB22,00000000), ref: 00C0C503

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: dcc58a2aa641beec8aba0bf567dd6db6512c7ed70537c4c89555b695cadcf8fb
Instruction ID: 0c9410054bd049b1e575f08bbd6df08d9cbb7df5a71da571cbcfa89fd111a177
Opcode Fuzzy Hash: dcc58a2aa641beec8aba0bf567dd6db6512c7ed70537c4c89555b695cadcf8fb
Instruction Fuzzy Hash: 0451C575900209AFCB10CFA8DC95BEEBBF4FF09300F14425AE955E7291E774AA41DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BF8FA9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 149COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,00000000,00000100,00000000,?,?,?,00BE700A,000000B8,0000001C,00000100), ref: 00BF8FD4
CompareStringW.KERNEL32(00000000,00000001,?,000000FF,00C1A4B8,000000FF,?,?,?,00BE700A,000000B8,0000001C,00000100,00000100,00000100,000000B0), ref: 00BF905E

Strings

c:\agent\_work\66\s\src\burn\engine\detect.cpp, xrefs: 00BF90BE
Failed to initialize update bundle., xrefs: 00BF9101
comres.dll, xrefs: 00BF90E0
BA aborted detect forward compatible bundle., xrefs: 00BF90C8

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CompareString
String ID: BA aborted detect forward compatible bundle.$Failed to initialize update bundle.$c:\agent\_work\66\s\src\burn\engine\detect.cpp$comres.dll
API String ID: 1825529933-4215571375
Opcode ID: 3d202f9695e85dc35139ddc64260b89eb530484bbf6f87f4072601fcdeaecaec
Instruction ID: 2065dececdb86fef4daf7cfaef5df767a40d120bc5d70168e2dd58d83784e266
Opcode Fuzzy Hash: 3d202f9695e85dc35139ddc64260b89eb530484bbf6f87f4072601fcdeaecaec
Instruction Fuzzy Hash: 43518171600219FBDF159F64CC85FB9B7A6FF05310F1442A8FA149B191C772E968DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C0FBC6 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000000,00000000,00000000), ref: 00C0FC0A
GetComputerNameW.KERNEL32(?,?), ref: 00C0FC62

Strings

Executable: %ls v%d.%d.%d.%d, xrefs: 00C0FCBE
--- logging level: %hs ---, xrefs: 00C0FD22
=== Logging started: %ls ===, xrefs: 00C0FC8D
Computer : %ls, xrefs: 00C0FCD0

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Name$ComputerFileModule
String ID: --- logging level: %hs ---$=== Logging started: %ls ===$Computer : %ls$Executable: %ls v%d.%d.%d.%d
API String ID: 2577110986-3153207428
Opcode ID: 327293d47f47082d5994f3bc0d9be2f6f040a01d3be4b025fe62123a3e417837
Instruction ID: faa9759e2a40f63cee79ce5874da7696ddee0defc3c51dae8e6b5dbd01ae451d
Opcode Fuzzy Hash: 327293d47f47082d5994f3bc0d9be2f6f040a01d3be4b025fe62123a3e417837
Instruction Fuzzy Hash: F7413FB290021CABDB309F64DD85BEA77BCEB55304F1041B9FA05A3582D6309EC5CA65

Uniqueness

Uniqueness Score: -1.00%

Function 00BED2BA Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 119COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,?,00000001,00C1A500,?,00000001,000000FF,?,?,75C0B390,00000000,00000001,00000000,?,00BE73D9), ref: 00BED3E3

Strings

Failed to create pipe and cache pipe., xrefs: 00BED340
Failed to elevate., xrefs: 00BED3C5
Failed to connect to elevated child process., xrefs: 00BED3CC
UX aborted elevation requirement., xrefs: 00BED2F8
Failed to create pipe name and client token., xrefs: 00BED324
c:\agent\_work\66\s\src\burn\engine\elevation.cpp, xrefs: 00BED2EE

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseHandle
String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$c:\agent\_work\66\s\src\burn\engine\elevation.cpp
API String ID: 2962429428-2367031576
Opcode ID: d1e43792f9780e0e19338cb546abfb54f5caf7274dc1ef3ed9ebb97fccefc663
Instruction ID: 77336a85957a9bf139c3d31ba1ea7e057435f6a4759122b8dc3dd60422240905
Opcode Fuzzy Hash: d1e43792f9780e0e19338cb546abfb54f5caf7274dc1ef3ed9ebb97fccefc663
Instruction Fuzzy Hash: 303140726417717BEB255661EC42FAAB6DCEF00720F104296F905B72C1EBE1ED4086EA

Uniqueness

Uniqueness Score: -1.00%

Function 00C18C74 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 118registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C10823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00C3AA7C,00000000,?,00C14FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00C10837

RegCloseKey.ADVAPI32(00000001,00000001,crypt32.dll,00000000,00000001,00C1A500,00000000,00000001,00000000,00020019,00000001,00000000,00000000,00020019,00000000,00000001), ref: 00C18D4C
RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,crypt32.dll,00000000,00000001,00C1A500,00000000,00000001,00000000,00020019), ref: 00C18D87
RegCloseKey.ADVAPI32(00000001,00000001,00020019,00000000,00000000,00000000,00000000,00000000,crypt32.dll), ref: 00C18DA3
RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000,00000000,crypt32.dll), ref: 00C18DB0
RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000,00000000,crypt32.dll), ref: 00C18DBD

Part of subcall function 00C10886: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00C18D39,00000001), ref: 00C1089E

Strings

crypt32.dll, xrefs: 00C18D30

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Close$InfoOpenQuery
String ID: crypt32.dll
API String ID: 796878624-1661610138
Opcode ID: 5e9dce932ff7972b414bfc2a6052ccb446c62ed514041f640cd20537edccc1a2
Instruction ID: ad14b493960ba725ca2882bf06ce7dcd149607ca1a48e4fada1b2f0f4ec7ad00
Opcode Fuzzy Hash: 5e9dce932ff7972b414bfc2a6052ccb446c62ed514041f640cd20537edccc1a2
Instruction Fuzzy Hash: 5A416872C0422EFFDF11AF949C819EDBA79EF16750F52416AEA0076161C7714E90BB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C0FDEF Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 116fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00C3B5D4,00000000,?,?,?,00BE4192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00BD5537,?), ref: 00C0FDFF
CreateFileW.KERNEL32(40000000,00000001,00000000,00000000,00000080,00000000,?,00000000,?,?,?,00C3B5CC,?,00BE4192,00000000,Setup), ref: 00C0FEA3
GetLastError.KERNEL32(?,00BE4192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00BD5537,?,?,?), ref: 00C0FEB3
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00BE4192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00BD5537,?), ref: 00C0FEED

Part of subcall function 00BD2EBC: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00BD3006

LeaveCriticalSection.KERNEL32(00C3B5D4,?,?,00C3B5CC,?,00BE4192,00000000,Setup,_Failed,txt,00000000,00000000,00000000,00000001,00BD5537,?), ref: 00C0FF46

Strings

c:\agent\_work\66\s\src\libs\dutil\logutil.cpp, xrefs: 00C0FED2

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
String ID: c:\agent\_work\66\s\src\libs\dutil\logutil.cpp
API String ID: 4111229724-727082060
Opcode ID: 07e138c43c26f09e7b9ad1de56bd707325f53d0459195cd425a96609a0c57516
Instruction ID: f8c9e8a71f414aca9886565ab1d1e86af2e21ca083f92411f9551fb02744ee99
Opcode Fuzzy Hash: 07e138c43c26f09e7b9ad1de56bd707325f53d0459195cd425a96609a0c57516
Instruction Fuzzy Hash: E731C63190022AEFDB316FA0DC45B6E7AA9FB01B50F004179FA10A66A1D771DE81DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C10E2F Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 116stringregistryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,BundleUpgradeCode), ref: 00C10E6B
lstrlenW.KERNEL32(?,00000002,00000001,?,00000002,00000001,00000000,00000000,BundleUpgradeCode), ref: 00C10ECD
lstrlenW.KERNEL32(?), ref: 00C10ED9
RegSetValueExW.ADVAPI32(?,?,00000000,00000007,?,?,00000001,?,?,00000002,00000001,00000000,00000000,BundleUpgradeCode), ref: 00C10F1C

Strings

BundleUpgradeCode, xrefs: 00C10E38
c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 00C10F44

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: lstrlen$Value
String ID: BundleUpgradeCode$c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 198323757-1890108899
Opcode ID: e9bb70a6aa60461ec609e7f76c4455d130f1e90a6a01ff1844a6c77563e35723
Instruction ID: b5dd7c334b2df5c6be054f436fd33964a34ce3fb4ac2d715f7d1ddfbf29e4694
Opcode Fuzzy Hash: e9bb70a6aa60461ec609e7f76c4455d130f1e90a6a01ff1844a6c77563e35723
Instruction Fuzzy Hash: CF319572900229AFCB21DFD98D85ADEBBB8FF45750F114495FD10AB210D770DD92ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BED0E4 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 109threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,00BEAC12,00000001,00000000,00000000), ref: 00BED170
GetLastError.KERNEL32(?,?,?,00BD54A3,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00BED17C

Part of subcall function 00BECDC8: WaitForSingleObject.KERNEL32(?,000493E0,00000000,?,?,00BED1EC,00000000,?,?,00BEC672,?,?,?,?,?,00BD54A3), ref: 00BECDDA
Part of subcall function 00BECDC8: GetLastError.KERNEL32(?,?,00BED1EC,00000000,?,?,00BEC672,?,?,?,?,?,00BD54A3,?,?,?), ref: 00BECDE4

CloseHandle.KERNEL32(00000000,00000000,?,?,00BEC672,?,?,?,?,?,00BD54A3,?,?,?,?), ref: 00BED1FD

Strings

Failed to pump messages in child process., xrefs: 00BED1D4
c:\agent\_work\66\s\src\burn\engine\elevation.cpp, xrefs: 00BED1A0
Failed to create elevated cache thread., xrefs: 00BED1AA

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$CloseCreateHandleObjectSingleThreadWait
String ID: Failed to create elevated cache thread.$Failed to pump messages in child process.$c:\agent\_work\66\s\src\burn\engine\elevation.cpp
API String ID: 3606931770-2334070456
Opcode ID: d36da0648467ce5c144c21d1ee6ab32f8178260bd101fa7b58d9bf4c9b8eea64
Instruction ID: c7469fc738a6508c1a35bf66f0eba2b1bfd4dd216a7f0ef3f1bffa99f1eaf69f
Opcode Fuzzy Hash: d36da0648467ce5c144c21d1ee6ab32f8178260bd101fa7b58d9bf4c9b8eea64
Instruction Fuzzy Hash: 5341E5B6D01229AF8B05DFA9D881ADEBBF4FF08710B11816AF804F7340E77499418F91

Uniqueness

Uniqueness Score: -1.00%

Function 00BD7337 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,?,?,00BD5966,00000100,00000100,00000000,?,00000001,00000000,00000100), ref: 00BD7349
LeaveCriticalSection.KERNEL32(00000000,00000000,00000100,00000000,?,?,?,00BD5966,00000100,00000100,00000000,?,00000001,00000000,00000100), ref: 00BD7428

Strings

Failed to get unformatted string., xrefs: 00BD73B9
Failed to get variable: %ls, xrefs: 00BD738A
Failed to format value '%ls' of variable: %ls, xrefs: 00BD73F2
Failed to get value as string for variable: %ls, xrefs: 00BD7417
*****, xrefs: 00BD73E4, 00BD73F1

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: *****$Failed to format value '%ls' of variable: %ls$Failed to get unformatted string.$Failed to get value as string for variable: %ls$Failed to get variable: %ls
API String ID: 3168844106-2873099529
Opcode ID: e07b2023c844546f204634ffbbbaf81df580c055e2f4bc0bb84c353d07ad85c7
Instruction ID: 15f02065d95a30d24fc3d121d11696a9817295c3034dc17449f8e443135c1d21
Opcode Fuzzy Hash: e07b2023c844546f204634ffbbbaf81df580c055e2f4bc0bb84c353d07ad85c7
Instruction Fuzzy Hash: C131A432884515BBCF225A50CC06BDDFAA4EF10325F1041A6F90066351FB759AA2EFC4

Uniqueness

Uniqueness Score: -1.00%

Function 00C12B5D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00C12B73
SysAllocString.OLEAUT32(?), ref: 00C12B8F
VariantClear.OLEAUT32(?), ref: 00C12C16
SysFreeString.OLEAUT32(00000000), ref: 00C12C21

Strings

`<u, xrefs: 00C12C21
c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 00C12BA6

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: StringVariant$AllocClearFreeInit
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 760788290-1301604586
Opcode ID: 9840dab9888730a0e79314b34a21b079a462b5650b0436b5d316869dfab4edf5
Instruction ID: 4b4f0562162ad3cc1004b47ff94b771094defb23d7e2ef9ecf03d8fb1f5f642d
Opcode Fuzzy Hash: 9840dab9888730a0e79314b34a21b079a462b5650b0436b5d316869dfab4edf5
Instruction Fuzzy Hash: 1121A639901125EFCB21DF54C848FEEBBB9AF46711F154098F912A7220DB30DE91EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BE8CC3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77COMMON

Download Yara Rule

APIs

InitializeAcl.ADVAPI32(?,00000008,00000002,0000001A,?,?,00000000,00000000,?,?,?), ref: 00BE8D0E
GetLastError.KERNEL32 ref: 00BE8D18
SetFileAttributesW.KERNEL32(?,00000080,?,00000001,20000004,00000000,00000000,?,00000000,00000003,000007D0,?,00000000,00000000,?,?), ref: 00BE8D78

Strings

c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00BE8D3C
Failed to allocate administrator SID., xrefs: 00BE8CF4
Failed to initialize ACL., xrefs: 00BE8D46

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AttributesErrorFileInitializeLast
String ID: Failed to allocate administrator SID.$Failed to initialize ACL.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 669721577-4043978521
Opcode ID: 07d2ac2ceba7d9f2890131b060851662cdcbcd3e69547973035751e602b2f168
Instruction ID: 879c6d4743c26362bbc0e0d2d5553bb9edf4d735724b9f3475f1bd7a9cd60219
Opcode Fuzzy Hash: 07d2ac2ceba7d9f2890131b060851662cdcbcd3e69547973035751e602b2f168
Instruction Fuzzy Hash: 02212B32A40654B7DB215AD69C45FDEB7E9BF11B50F11C0B9F904FB2C1EB749D0096A0

Uniqueness

Uniqueness Score: -1.00%

Function 00BD4263 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

GetCurrentDirectoryW.KERNEL32(00000000,00000000,?,00000000,crypt32.dll,?,?,00BE3FAF,00000001,feclient.dll,?,00000000,?,?,?,00BD4B57), ref: 00BD429E
GetLastError.KERNEL32(?,?,00BE3FAF,00000001,feclient.dll,?,00000000,?,?,?,00BD4B57,?,?,00C1A488,?,00000001), ref: 00BD42AA
GetCurrentDirectoryW.KERNEL32(00000000,?,?,00000000,?,?,00BE3FAF,00000001,feclient.dll,?,00000000,?,?,?,00BD4B57,?), ref: 00BD42E5
GetLastError.KERNEL32(?,?,00BE3FAF,00000001,feclient.dll,?,00000000,?,?,?,00BD4B57,?,?,00C1A488,?,00000001), ref: 00BD42EF

Strings

c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp, xrefs: 00BD4313
crypt32.dll, xrefs: 00BD4267

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CurrentDirectoryErrorLast
String ID: c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp$crypt32.dll
API String ID: 152501406-3173697099
Opcode ID: ed2856339e5d4ecd30f9aab065399b343aaf700791e5926e50eede57cdb4640a
Instruction ID: 18b28a32ee9bc5e72eb8c80f4bca4106f4ab9aa29df73d8cc58d7e92b795b5b5
Opcode Fuzzy Hash: ed2856339e5d4ecd30f9aab065399b343aaf700791e5926e50eede57cdb4640a
Instruction Fuzzy Hash: 5F11A276E01636AB97218AD95844BAFF6D8EF06764B1241B6BD00F7300F734DC008BE4

Uniqueness

Uniqueness Score: -1.00%

Function 00BF0937 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74fileCOMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00BF0987
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00BF09A6
GetLastError.KERNEL32 ref: 00BF09B0

Strings

Unexpected call to CabWrite()., xrefs: 00BF096A
Failed to write during cabinet extraction., xrefs: 00BF09DE
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00BF09D4

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorFileLastWrite_memcpy_s
String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 1970631241-3210721340
Opcode ID: 8594f166e77ad6e64a05eee02357249af2021422a7c1257d87a91373cd45ad07
Instruction ID: fbc7448748613129a8cb4f0f5d56b5580ffb0f2f7b9f4cfa0c977157480a82eb
Opcode Fuzzy Hash: 8594f166e77ad6e64a05eee02357249af2021422a7c1257d87a91373cd45ad07
Instruction Fuzzy Hash: E921FF76510209EBDB00DF6DD981EAA77E9EF84724B118099FB04D7263E2B1D900DB20

Uniqueness

Uniqueness Score: -1.00%

Function 00BD9A9F Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 72COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00BD9AB8
GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,?,00BDA889,00000100,000002C0,000002C0,00000100), ref: 00BD9ACD
GetLastError.KERNEL32(?,00BDA889,00000100,000002C0,000002C0,00000100), ref: 00BD9ADA

Strings

Failed while searching directory search: %ls, for path: %ls, xrefs: 00BD9B1A
Failed to set variable., xrefs: 00BD9B3F
Failed to format variable string., xrefs: 00BD9AC3

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AttributesErrorFileLastOpen@16
String ID: Failed to format variable string.$Failed to set variable.$Failed while searching directory search: %ls, for path: %ls
API String ID: 1811509786-402580132
Opcode ID: 03f77e420e323db5a165ec45997bbd308941ddea191d1909500ffd61cf24df71
Instruction ID: 477248a8ab5d7c0eeb9fb280f25bf333880db23f60310833862c50ae374b1945
Opcode Fuzzy Hash: 03f77e420e323db5a165ec45997bbd308941ddea191d1909500ffd61cf24df71
Instruction Fuzzy Hash: C1110633A40421BBDF226664EC02FEEF695EF01320F2242A7F811A63A1F7619D40F6D1

Uniqueness

Uniqueness Score: -1.00%

Function 00BF09FE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 00BF0A6B
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00BF0A7D
SetFileTime.KERNEL32(?,?,?,?), ref: 00BF0A90
CloseHandle.KERNEL32(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,00BF0660,?,?), ref: 00BF0A9F

Strings

Invalid operation for this state., xrefs: 00BF0A44
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00BF0A3A

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Time$File$CloseDateHandleLocal
String ID: Invalid operation for this state.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 609741386-2444813713
Opcode ID: 0fb284084f73dc8950ae654218fb2ff91a263ecb7db6744c82fec4d6b84f8602
Instruction ID: 520db7b09bc41fe0104af6a94f409fde5e5ade65dec542b86220c4ba4d536004
Opcode Fuzzy Hash: 0fb284084f73dc8950ae654218fb2ff91a263ecb7db6744c82fec4d6b84f8602
Instruction Fuzzy Hash: CA21F07292061EEF8B10AFA8DC089FABBECFE04720B108256F951D75E1D374D914DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C089AF Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00C08973: _free.LIBCMT ref: 00C0899C

_free.LIBCMT ref: 00C089FD

Part of subcall function 00C05CE8: HeapFree.KERNEL32(00000000,00000000,?,00C089A1,?,00000000,?,00000000,?,00C089C8,?,00000007,?,?,00C08E2A,?), ref: 00C05CFE
Part of subcall function 00C05CE8: GetLastError.KERNEL32(?,?,00C089A1,?,00000000,?,00000000,?,00C089C8,?,00000007,?,?,00C08E2A,?,?), ref: 00C05D10

_free.LIBCMT ref: 00C08A08
_free.LIBCMT ref: 00C08A13
_free.LIBCMT ref: 00C08A67
_free.LIBCMT ref: 00C08A72
_free.LIBCMT ref: 00C08A7D
_free.LIBCMT ref: 00C08A88

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 48635352fcdb93915df3ba2fc5eddb2e5b53a02fac6a758a8558f49e26154fd7
Instruction ID: f32a8c231ee2aedf8ae2d62b62126fec03c517f83d9257a5cfb8ae793676d68d
Opcode Fuzzy Hash: 48635352fcdb93915df3ba2fc5eddb2e5b53a02fac6a758a8558f49e26154fd7
Instruction Fuzzy Hash: 2411EF71640B04ABE920BBB0DC47FDB77DC6F05700F808816B2D9661D2DA65B608FA95

Uniqueness

Uniqueness Score: -1.00%

Function 00BE45CE Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00BD39DF: GetProcessHeap.KERNEL32(?,000001C7,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F0
Part of subcall function 00BD39DF: RtlAllocateHeap.NTDLL(00000000,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F7

_memcpy_s.LIBCMT ref: 00BE461F
_memcpy_s.LIBCMT ref: 00BE4632
_memcpy_s.LIBCMT ref: 00BE464D

Strings

Failed to allocate memory for message., xrefs: 00BE4608
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 00BE45FE
crypt32.dll, xrefs: 00BE4629, 00BE4648

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: _memcpy_s$Heap$AllocateProcess
String ID: Failed to allocate memory for message.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp$crypt32.dll
API String ID: 886498622-1118502555
Opcode ID: 8ad5d5c51ab69eaba94ac147c4b545582d56af96972f8ec6492497786063127d
Instruction ID: 2d692ee20ccaa67d5b21deab84c585c6a6c7438d392329492860780c9165270e
Opcode Fuzzy Hash: 8ad5d5c51ab69eaba94ac147c4b545582d56af96972f8ec6492497786063127d
Instruction Fuzzy Hash: 72118FB250035ABBDB01DE94DC82DEBB3ECEF05B14B044567BA11DB252E775DA1087E1

Uniqueness

Uniqueness Score: -1.00%

Function 00C134C7 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 00C1351B
GetLastError.KERNEL32 ref: 00C13525
CloseHandle.KERNEL32(?), ref: 00C13558

Strings

PDu, xrefs: 00C1351B
c:\agent\_work\66\s\src\libs\dutil\shelutil.cpp, xrefs: 00C13546
<, xrefs: 00C1350D

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseErrorExecuteHandleLastShell
String ID: <$PDu$c:\agent\_work\66\s\src\libs\dutil\shelutil.cpp
API String ID: 3023784893-2506374349
Opcode ID: 195e954531c84015792e29e4ca6670541221eb9d366e89f7cfedf2ca71371611
Instruction ID: a725bf40cd3e1aad7421c758bf17307a2ad6c31f69926f2ddaa96c831b589ea0
Opcode Fuzzy Hash: 195e954531c84015792e29e4ca6670541221eb9d366e89f7cfedf2ca71371611
Instruction Fuzzy Hash: 5E21B7B5E11229DBCB10CF99D944ADEBBF8BF09B54F10815AF915E7340E3749A409FA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BD9A0E Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 56COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00BD9A85

Strings

Failed to get Condition inner text., xrefs: 00BD9A55
Failed to select condition node., xrefs: 00BD9A3C
`<u, xrefs: 00BD9A85
Condition, xrefs: 00BD9A20
Failed to copy condition string from BSTR, xrefs: 00BD9A6F

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: FreeString
String ID: Condition$Failed to copy condition string from BSTR$Failed to get Condition inner text.$Failed to select condition node.$`<u
API String ID: 3341692771-266405526
Opcode ID: 57835171312233def7bd675b53fdc7852c16c50ba38fd8c323706f3ef6b2b5b6
Instruction ID: 9225262b733e21aa49f5058b95b36e1d0bf2735c3521753da4f6011ee7ce5117
Opcode Fuzzy Hash: 57835171312233def7bd675b53fdc7852c16c50ba38fd8c323706f3ef6b2b5b6
Instruction Fuzzy Hash: 3B115232941228BBDF15A7A4EC46BEDFFB4EF01710F1141A6F801B6351E7719E40E680

Uniqueness

Uniqueness Score: -1.00%

Function 00C1038A Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00BD5EE0,00000000), ref: 00C1039E
GetProcAddress.KERNEL32(00000000), ref: 00C103A5
GetLastError.KERNEL32(?,?,?,00BD5EE0,00000000), ref: 00C103BC

Strings

IsWow64Process, xrefs: 00C1038F
kernel32, xrefs: 00C10396
c:\agent\_work\66\s\src\libs\dutil\procutil.cpp, xrefs: 00C103DD

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AddressErrorHandleLastModuleProc
String ID: IsWow64Process$c:\agent\_work\66\s\src\libs\dutil\procutil.cpp$kernel32
API String ID: 4275029093-3797636953
Opcode ID: 79eafe461660094aee300594ec17ff826c56b7d82460bb57c55cbf140626ebc4
Instruction ID: 1d47c920116b5fe62211946953b58ae0610dd7e634930bca6349bba1ff781750
Opcode Fuzzy Hash: 79eafe461660094aee300594ec17ff826c56b7d82460bb57c55cbf140626ebc4
Instruction Fuzzy Hash: 99F02236A01236AB87218B959D09ACFBA64EF0AB50B518150BE15B7250E7F4DFC0E7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00C09A87 Relevance: 9.2, APIs: 6, Instructions: 216COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,00C02C74,00C02C74,?,?,?,00C09CD8,00000001,00000001,BCE85006), ref: 00C09AE1
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00C09CD8,00000001,00000001,BCE85006,?,?,?), ref: 00C09B67
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,BCE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00C09C61
__freea.LIBCMT ref: 00C09C6E

Part of subcall function 00C05D22: HeapAlloc.KERNEL32(00000000,?,?,?,00C01782,?,0000015D,?,?,?,?,00C02BDB,000000FF,00000000,?,?), ref: 00C05D54

__freea.LIBCMT ref: 00C09C77
__freea.LIBCMT ref: 00C09C9C

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocHeap
String ID:
API String ID: 3147120248-0
Opcode ID: 22a8ff25a3b21f570383f1d151a9ae3adc6d601b724cf086943f8176986a728e
Instruction ID: af38f6949ab8163b0317f6a0d34cbe873e325562d5244e4c05f4e4a7a402ffd2
Opcode Fuzzy Hash: 22a8ff25a3b21f570383f1d151a9ae3adc6d601b724cf086943f8176986a728e
Instruction Fuzzy Hash: 7E51D272A00216ABEB258F65CC81FBF77EAEB40750F144628FD15D61D2EB34DE44D660

Uniqueness

Uniqueness Score: -1.00%

Function 00BE8B85 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 121sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0,00000000,00000000), ref: 00BE8BF1

Strings

Failed to get %hs package cache root directory., xrefs: 00BE8C51
per-user, xrefs: 00BE8C4B, 00BE8C50, 00BE8C8B, 00BE8C90
Failed to calculate cache path., xrefs: 00BE8BAE
per-machine, xrefs: 00BE8C42, 00BE8C82
Failed to get old %hs package cache root directory., xrefs: 00BE8C91

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Sleep
String ID: Failed to calculate cache path.$Failed to get %hs package cache root directory.$Failed to get old %hs package cache root directory.$per-machine$per-user
API String ID: 3472027048-398165853
Opcode ID: d8bd49e39f3e83e73d26f154b043bc3ba647601077dff5ff3b2a5dd6c5c56497
Instruction ID: 1f267f474ab2b57be31901e01d579afcd54fd9029585c1d89aad93125b34a74f
Opcode Fuzzy Hash: d8bd49e39f3e83e73d26f154b043bc3ba647601077dff5ff3b2a5dd6c5c56497
Instruction Fuzzy Hash: 5E314872941A65BFEB11A6668D46F7F62ECDB01B10F2000E1FD09FA342EB74DD0096B1

Uniqueness

Uniqueness Score: -1.00%

Function 00BEE7A7 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000082,?,?), ref: 00BEE7D6
SetWindowLongW.USER32(?,000000EB,00000000), ref: 00BEE7E5
SetWindowLongW.USER32(?,000000EB,?), ref: 00BEE7F9
DefWindowProcW.USER32(?,?,?,?), ref: 00BEE809
GetWindowLongW.USER32(?,000000EB), ref: 00BEE823
PostQuitMessage.USER32(00000000), ref: 00BEE882

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Window$Long$Proc$MessagePostQuit
String ID:
API String ID: 3812958022-0
Opcode ID: 944e5ac47898e7b3127ff049aa325c03ab627cae681bf00a39497e0880dcc569
Instruction ID: 16a54f8868845a50ccaac63b13fe4f856b44ff604fc8d97932cf548fd6d1adba
Opcode Fuzzy Hash: 944e5ac47898e7b3127ff049aa325c03ab627cae681bf00a39497e0880dcc569
Instruction Fuzzy Hash: 1521AE32100114AFDB055F68DC48FAE3FA5FF45720F5482A8F92A9A2B1C731DD10DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00C05929 Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00C012E7,00000000,80004004,?,00C015EB,00000000,80004004,00000000,00000000), ref: 00C0592D
_free.LIBCMT ref: 00C05960
_free.LIBCMT ref: 00C05988
SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 00C05995
SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 00C059A1
_abort.LIBCMT ref: 00C059A7

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: c320a45f4f98e691f655c8bd3f51613bf33f68882a5f862576c7058b15a6d42f
Instruction ID: 809adfa01f248b2576cc59b412619f5ff1e189ce9fc193e9c1cccbf30dbfdb84
Opcode Fuzzy Hash: c320a45f4f98e691f655c8bd3f51613bf33f68882a5f862576c7058b15a6d42f
Instruction Fuzzy Hash: 7AF04636241F01EBC6163339AC0AF5F251AAFC6730B254114F429E21E1EF208E03E962

Uniqueness

Uniqueness Score: -1.00%

Function 00BEC672 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 164synchronizationCOMMON

Download Yara Rule

APIs

ReleaseMutex.KERNEL32(?), ref: 00BEC6BA
CloseHandle.KERNEL32(?), ref: 00BEC6C2

Strings

Unexpected elevated message sent to child process, msg: %u, xrefs: 00BEC86D
Failed to save state., xrefs: 00BEC73A
c:\agent\_work\66\s\src\burn\engine\elevation.cpp, xrefs: 00BEC861

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseHandleMutexRelease
String ID: Failed to save state.$Unexpected elevated message sent to child process, msg: %u$c:\agent\_work\66\s\src\burn\engine\elevation.cpp
API String ID: 4207627910-1654385460
Opcode ID: 4a086a65cd78bb9bce006bd543002ff2ac7b02cfd83e655cc4e31afb66f557df
Instruction ID: ae3e12673e8f6ecf595895ba4eb8c7f8b1d53a54adb9fe3f27b4faa8f90bb702
Opcode Fuzzy Hash: 4a086a65cd78bb9bce006bd543002ff2ac7b02cfd83e655cc4e31afb66f557df
Instruction Fuzzy Hash: C961A77A100550EFCB125F95CE41C66BFF2FF08710715C5A9FA6A5A632C732E922EB41

Uniqueness

Uniqueness Score: -1.00%

Function 00C172DE Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 161COMMON

Download Yara Rule

APIs

Part of subcall function 00BD39DF: GetProcessHeap.KERNEL32(?,000001C7,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F0
Part of subcall function 00BD39DF: RtlAllocateHeap.NTDLL(00000000,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F7

SysFreeString.OLEAUT32(00000000), ref: 00C1743B
SysFreeString.OLEAUT32(00000000), ref: 00C17446
SysFreeString.OLEAUT32(00000000), ref: 00C17451

Strings

`<u, xrefs: 00C17430
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 00C17311

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp
API String ID: 2724874077-3052637621
Opcode ID: ea74adf87b4d8f2d1fd650258f31d6408d5357f36f8803f2ac4e281a98fa185d
Instruction ID: 8836ff70bd31af85fc5909d3141629fb10383465404701430c00dbd6148a2900
Opcode Fuzzy Hash: ea74adf87b4d8f2d1fd650258f31d6408d5357f36f8803f2ac4e281a98fa185d
Instruction Fuzzy Hash: 2F51853190522AAFDB11DF64C844EEEBBB8AF05714F114299E915AB250D770EE84EFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C10AB4 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 147registrystringCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 00C10ADC
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,00BE6FDF,00000100,000000B0,00000088,00000410,000002C0), ref: 00C10B13
lstrlenW.KERNEL32(?,?,?,00000000,?,-00000001,00000004,00000000), ref: 00C10C05

Strings

BundleUpgradeCode, xrefs: 00C10ABB
c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 00C10B56

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: QueryValue$lstrlen
String ID: BundleUpgradeCode$c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 3790715954-1890108899
Opcode ID: 95b60128959f5c8363e60bc11b67e0807c03067dbffaa5165bcce2f0222cf079
Instruction ID: 580d71f759c11917acb47248cc4d2ad234817f5860653256426f4bb6fb6498ca
Opcode Fuzzy Hash: 95b60128959f5c8363e60bc11b67e0807c03067dbffaa5165bcce2f0222cf079
Instruction Fuzzy Hash: BC41B531A0011AEBCB21DF55C845AEEB7B9EF06714F21416AF811AB211D6B0DEC1EFE1

Uniqueness

Uniqueness Score: -1.00%

Function 00C15B40 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C1412E: SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,00BE8651,00000000,00000000,00000000,00000000,00000000), ref: 00C14146
Part of subcall function 00C1412E: GetLastError.KERNEL32(?,?,?,00BE8651,00000000,00000000,00000000,00000000,00000000), ref: 00C14150

WriteFile.KERNEL32(?,?,00000000,?,00000000,?,00C153FE,?,?,?,?,?,?,?,00010000,?), ref: 00C15BA9
WriteFile.KERNEL32(000000FF,00000008,00000008,?,00000000,000000FF,00000000,00000000,00000000,00000000,?,00C153FE,?,?,?,?), ref: 00C15BFB
GetLastError.KERNEL32(?,00C153FE,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 00C15C41
GetLastError.KERNEL32(?,00C153FE,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 00C15C67

Strings

c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp, xrefs: 00C15C8B

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorFileLast$Write$Pointer
String ID: c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp
API String ID: 133221148-16760509
Opcode ID: 18758e22b18ab6a91ccd9f12f1d1abb31bd32a9baf4b2f013bf81d6ec64fa1a7
Instruction ID: 288c6796a21bcf858fd5c9c5f95d8c61aa42be98a676beab56827c84aa87cf18
Opcode Fuzzy Hash: 18758e22b18ab6a91ccd9f12f1d1abb31bd32a9baf4b2f013bf81d6ec64fa1a7
Instruction Fuzzy Hash: BD417C7250071AFFDB218E94CD44BEE7BA8BF4A350F154125BD11A6190D374DDA0EAA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BD252E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120COMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,00000000,00C0F8C7,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00C0F8C7,00BF1074,?,00000000), ref: 00BD2574
GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00C0F8C7,00BF1074,?,00000000,0000FDE9,?,00BF1074), ref: 00BD2580

Part of subcall function 00BD3C5F: GetProcessHeap.KERNEL32(00000000,000001C7,?,00BD22D5,000001C7,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD3C67
Part of subcall function 00BD3C5F: HeapSize.KERNEL32(00000000,?,00BD22D5,000001C7,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD3C6E

Strings

c:\agent\_work\66\s\src\libs\dutil\strutil.cpp, xrefs: 00BD25A4

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: c:\agent\_work\66\s\src\libs\dutil\strutil.cpp
API String ID: 3662877508-792799584
Opcode ID: a0af4da1203fdb45fc9e9d663909e43c273a1622e4dd8c41a29b680bfe7eb7b0
Instruction ID: dc42239c771c433649a6d78788db77cd2a171bd3ad649916d0e3698324928f7e
Opcode Fuzzy Hash: a0af4da1203fdb45fc9e9d663909e43c273a1622e4dd8c41a29b680bfe7eb7b0
Instruction Fuzzy Hash: CE31E571200386AFEB109F649DD0E76B7D9EB75768B1042ABFD119B391FA61CC009761

Uniqueness

Uniqueness Score: -1.00%

Function 00C13A14 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

MoveFileExW.KERNEL32(00000003,00000001,00000000,00000000,00000101,?,00C13B62,00000003,00000001,00000001,000007D0,00000003,00000000,?,00BE9F39,00000001), ref: 00C13A32
GetLastError.KERNEL32(00000002,?,00C13B62,00000003,00000001,00000001,000007D0,00000003,00000000,?,00BE9F39,00000001,000007D0,00000001,00000001,00000003), ref: 00C13A41
MoveFileExW.KERNEL32(00000003,00000001,00000000,00000001,00000000,?,00C13B62,00000003,00000001,00000001,000007D0,00000003,00000000,?,00BE9F39,00000001), ref: 00C13ADA
GetLastError.KERNEL32(?,00C13B62,00000003,00000001,00000001,000007D0,00000003,00000000,?,00BE9F39,00000001,000007D0,00000001,00000001,00000003,000007D0), ref: 00C13AE4

Part of subcall function 00C13C72: FindFirstFileW.KERNEL32(00BF8F6B,?,00000100,00000000,00000000), ref: 00C13CAD
Part of subcall function 00C13C72: FindClose.KERNEL32(00000000), ref: 00C13CB9

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 00C13B03

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: File$ErrorFindLastMove$CloseFirst
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 3479031965-1688708105
Opcode ID: 0ac9b2432a72b321a3648f6be9da619293632c19eba1283fef4f2601c1d9de3e
Instruction ID: f39a4b3dfacab2072ef8b33dab516775a17685c37073c0d28ffa7313602583bd
Opcode Fuzzy Hash: 0ac9b2432a72b321a3648f6be9da619293632c19eba1283fef4f2601c1d9de3e
Instruction Fuzzy Hash: 7E312832A042A2A7DB214E599C01BFF7695EF477A8F154126FC54AB251E370CFC1B2D4

Uniqueness

Uniqueness Score: -1.00%

Function 00BFAA41 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 106COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,?,000000FF,?,00000000,?,?,?,00000000,00000000,?,?,00000000), ref: 00BFAAB0

Strings

Failed to extract all payloads from container: %ls, xrefs: 00BFAAF4
Failed to open container: %ls., xrefs: 00BFAA82
Failed to skip the extraction of payload: %ls from container: %ls, xrefs: 00BFAB45
Failed to extract payload: %ls from container: %ls, xrefs: 00BFAB39

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CompareString
String ID: Failed to extract all payloads from container: %ls$Failed to extract payload: %ls from container: %ls$Failed to open container: %ls.$Failed to skip the extraction of payload: %ls from container: %ls
API String ID: 1825529933-3891707333
Opcode ID: b47f166a178ba841eea80051477e82196195535abcb02452b0c4ed843d46b299
Instruction ID: 51edf5757a6833b3dcce0c4797a6cc64f6f39b8a014e7e68d84e031f4c959211
Opcode Fuzzy Hash: b47f166a178ba841eea80051477e82196195535abcb02452b0c4ed843d46b299
Instruction Fuzzy Hash: F131AB72D0051ABBCF11DED4CD82E9EB7A9AF04710F1041A1FA1577292E7309959DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C171DB Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 104COMMON

Download Yara Rule

APIs

Part of subcall function 00BD39DF: GetProcessHeap.KERNEL32(?,000001C7,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F0
Part of subcall function 00BD39DF: RtlAllocateHeap.NTDLL(00000000,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F7

SysFreeString.OLEAUT32(00000000), ref: 00C172BE
SysFreeString.OLEAUT32(?), ref: 00C172C9
SysFreeString.OLEAUT32(00000000), ref: 00C172D4

Strings

`<u, xrefs: 00C172B3
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 00C17208

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: FreeString$Heap$AllocateProcess
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp
API String ID: 2724874077-3052637621
Opcode ID: 6d06321885fd64beae92a28bddd849c90bd1b1df07a9d34ccd6c4fbec20626c4
Instruction ID: caf3ed748475d68271cee91d57845cf4c0fe1ac435cb113fd2a45ef205ebcc2b
Opcode Fuzzy Hash: 6d06321885fd64beae92a28bddd849c90bd1b1df07a9d34ccd6c4fbec20626c4
Instruction Fuzzy Hash: DD31A532D04629FBDB229B95CC45FDEB7B8AF42720F114295F910BB250D770DE86AB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C13B71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 94registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C13C72: FindFirstFileW.KERNEL32(00BF8F6B,?,00000100,00000000,00000000), ref: 00C13CAD
Part of subcall function 00C13C72: FindClose.KERNEL32(00000000), ref: 00C13CB9

RegCloseKey.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 00C13C64

Part of subcall function 00C10823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00C3AA7C,00000000,?,00C14FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00C10837

Part of subcall function 00C10AB4: RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 00C10ADC
Part of subcall function 00C10AB4: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,00BE6FDF,00000100,000000B0,00000088,00000410,000002C0), ref: 00C10B13

Strings

\, xrefs: 00C13BED
SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00C13BA3
crypt32.dll, xrefs: 00C13B9C
PendingFileRenameOperations, xrefs: 00C13BCF

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseFindQueryValue$FileFirstOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager$\$crypt32.dll
API String ID: 3397690329-3978359083
Opcode ID: a187ca09430a794048f292ff8ced4f42ccb771d244aefa0409da41c57b3cefd3
Instruction ID: 2be49ca7d6251aa093d968dc526c2123de998dd3e61a274b43adcf226a9623c8
Opcode Fuzzy Hash: a187ca09430a794048f292ff8ced4f42ccb771d244aefa0409da41c57b3cefd3
Instruction Fuzzy Hash: 1F31B331900259FADF21AF84CC519EEBBB5EF12754F14826AE511B6151D7318BC0EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BDEFB7 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94registryCOMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(0000007F,00000000,00000001,000000FF,?,000000FF,00000001,PackageVersion,00000001,?,00BE05EB,00000001,00000001,00000001,00BE05EB,00000000), ref: 00BDF02F
RegCloseKey.ADVAPI32(00000000,00000001,PackageVersion,00000001,?,00BE05EB,00000001,00000001,00000001,00BE05EB,00000000,00000001,00000000,?,00BE05EB,00000001), ref: 00BDF04C

Strings

PackageVersion, xrefs: 00BDF010
Failed to remove update registration key: %ls, xrefs: 00BDF077
Failed to format key for update registration., xrefs: 00BDEFE5

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseCompareString
String ID: Failed to format key for update registration.$Failed to remove update registration key: %ls$PackageVersion
API String ID: 446873843-3222553582
Opcode ID: 157f42f696a88b7d2381f05e69acf3cf19093b1bcbb864b381ef313d387f272d
Instruction ID: fc973e8995587ad56ef271912b34d0ac4dc79e6b19ccfe5f042d3b4024d0ad5d
Opcode Fuzzy Hash: 157f42f696a88b7d2381f05e69acf3cf19093b1bcbb864b381ef313d387f272d
Instruction Fuzzy Hash: 10219531D05126BACB21AFA5DD05BBEFEF8EF05760F1041B6B815A7292F7709E40D690

Uniqueness

Uniqueness Score: -1.00%

Function 00C13843 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(00000000,00BD4DFD,00000000,?,?,00000000,?,00C1395E,00000000,00BD4DFD,00000000,00000000,?,00BE84D1,?,?), ref: 00C1385D
GetLastError.KERNEL32(?,00C1395E,00000000,00BD4DFD,00000000,00000000,?,00BE84D1,?,?,00000001,00000003,000007D0,?,?,?), ref: 00C1386B
CopyFileW.KERNEL32(00000000,00BD4DFD,00000000,00BD4DFD,00000000,?,00C1395E,00000000,00BD4DFD,00000000,00000000,?,00BE84D1,?,?,00000001), ref: 00C138DD
GetLastError.KERNEL32(?,00C1395E,00000000,00BD4DFD,00000000,00000000,?,00BE84D1,?,?,00000001,00000003,000007D0,?,?,?), ref: 00C138E7

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 00C13906

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CopyErrorFileLast
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 374144340-1688708105
Opcode ID: 6429a1f144129c4c44477e3e424006a389212972eb3443030710eb3d4a4778d8
Instruction ID: 1d0d0216124b5fa27a9231b5e557e60828f525f6baf7aa0f398d46217cd35860
Opcode Fuzzy Hash: 6429a1f144129c4c44477e3e424006a389212972eb3443030710eb3d4a4778d8
Instruction Fuzzy Hash: 2F213B37A007A297BB201B954C00BFB6698EF57B74F014066FD18EB250EAA4CF8172D5

Uniqueness

Uniqueness Score: -1.00%

Function 00BDEECF Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00BDEF0A

Part of subcall function 00C13984: SetFileAttributesW.KERNEL32(00BF8F6B,00000080,00000000,00BF8F6B,000000FF,00000000,?,?,00BF8F6B), ref: 00C139B3
Part of subcall function 00C13984: GetLastError.KERNEL32(?,?,00BF8F6B), ref: 00C139BD

Part of subcall function 00BD3CF7: RemoveDirectoryW.KERNEL32(00000001,00000000,00000000,00000000,?,?,00BDEF55,00000001,00000000,00000095,00000001,00BE05FA,00000095,00000000,swidtag,00000001), ref: 00BD3D14

Strings

swidtag, xrefs: 00BDEF19
Failed to allocate regid file path., xrefs: 00BDEF69
Failed to allocate regid folder path., xrefs: 00BDEF70
Failed to format tag folder path., xrefs: 00BDEF77

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AttributesDirectoryErrorFileLastOpen@16Remove
String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to format tag folder path.$swidtag
API String ID: 1428973842-4170906717
Opcode ID: 9625ced51beb702d0f523cd126f383da7110e0eb05fb2f5edec17dd6ca82d7d1
Instruction ID: 9b5496fb64744d41db3c9a53c6ab029237aaa9d8cbd770ce98704574046a6455
Opcode Fuzzy Hash: 9625ced51beb702d0f523cd126f383da7110e0eb05fb2f5edec17dd6ca82d7d1
Instruction Fuzzy Hash: 97214A31D00228FBDB15AB98DD41A9DFBF5EF54710F14C0A6A424AA261E771DE50DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BF8AF2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 85registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C10823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00C3AA7C,00000000,?,00C14FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00C10837

CompareStringW.KERNEL32(00000000,00000001,00000000,000000FF,?,000000FF,00000000,00000000,00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4), ref: 00BF8B76
RegCloseKey.ADVAPI32(00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4,?,?,?,00BDF782,00000001,00000100,000001B4,00000000), ref: 00BF8BC4

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00BF8B13
Failed to enumerate uninstall key for related bundles., xrefs: 00BF8BD3
Failed to open uninstall registry key., xrefs: 00BF8B39

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseCompareOpenString
String ID: Failed to enumerate uninstall key for related bundles.$Failed to open uninstall registry key.$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
API String ID: 2817536665-2531018330
Opcode ID: a66d3e4051a8aca1b4c5ebdcd50ca41e842ab6309f28d00dab190ac1bf7e4fb6
Instruction ID: 394632b0fc0264fe58bfd054485cd6b4e1e2dc667133eee6c100088fe87f78c2
Opcode Fuzzy Hash: a66d3e4051a8aca1b4c5ebdcd50ca41e842ab6309f28d00dab190ac1bf7e4fb6
Instruction Fuzzy Hash: 6821B57291022CFFDF119B94DC86FEEBAB9EF01360F2442A4F911770A1D6764E94E690

Uniqueness

Uniqueness Score: -1.00%

Function 00BFCF33 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 79synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00BD39DF: GetProcessHeap.KERNEL32(?,000001C7,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F0
Part of subcall function 00BD39DF: RtlAllocateHeap.NTDLL(00000000,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F7

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00BFCFC8
ReleaseMutex.KERNEL32(?), ref: 00BFCFF6
SetEvent.KERNEL32(?), ref: 00BFCFFF

Strings

Failed to allocate buffer., xrefs: 00BFCF77
c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp, xrefs: 00BFCF6D

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Heap$AllocateEventMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate buffer.$c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp
API String ID: 944053411-3017045536
Opcode ID: 2ee36d4b39eedac85e60ecb39fb3a19f98a1b5b5d02a6ab36e2003533c398865
Instruction ID: a24f2a6ae6f457d0ee01b0c67bbcede2ffa244b95a99fa6f5893dea0c7a0bee2
Opcode Fuzzy Hash: 2ee36d4b39eedac85e60ecb39fb3a19f98a1b5b5d02a6ab36e2003533c398865
Instruction Fuzzy Hash: 7321D1B160020ABFDB109F28D845AA9FBF5FF48310F108679F965A7392C375A995CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C15100 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

QueryServiceConfigW.ADVAPI32(00000000,00000000,00000000,?,00000001,00000000,?,?,00BF6879,00000000,?), ref: 00C15116
GetLastError.KERNEL32(?,?,00BF6879,00000000,?,?,?,?,?,?,?,?,?,00BF6C89,?,?), ref: 00C15124

Part of subcall function 00BD39DF: GetProcessHeap.KERNEL32(?,000001C7,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F0
Part of subcall function 00BD39DF: RtlAllocateHeap.NTDLL(00000000,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F7

QueryServiceConfigW.ADVAPI32(00000000,00000000,?,?,?,00000001,?,?,00BF6879,00000000,?), ref: 00C1515E
GetLastError.KERNEL32(?,?,00BF6879,00000000,?,?,?,?,?,?,?,?,?,00BF6C89,?,?), ref: 00C15168

Strings

c:\agent\_work\66\s\src\libs\dutil\svcutil.cpp, xrefs: 00C15147, 00C15189

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ConfigErrorHeapLastQueryService$AllocateProcess
String ID: c:\agent\_work\66\s\src\libs\dutil\svcutil.cpp
API String ID: 355237494-2416947055
Opcode ID: 231f6a54b851b1d7d3e96d4182519a168f3eee5c46fbc2e1db331901bd3a7e79
Instruction ID: 7c32d65d44d0f00f839c965def5726592578594a4f9bb9d4c8e5525d247f6541
Opcode Fuzzy Hash: 231f6a54b851b1d7d3e96d4182519a168f3eee5c46fbc2e1db331901bd3a7e79
Instruction Fuzzy Hash: 3A213837901535F7D72296458D05BDFA9A9AFC3B60F224015BD01BB210E675CE80B6E1

Uniqueness

Uniqueness Score: -1.00%

Function 00C12AB1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00C12AC4
VariantInit.OLEAUT32(?), ref: 00C12AD0
VariantClear.OLEAUT32(?), ref: 00C12B44
SysFreeString.OLEAUT32(00000000), ref: 00C12B4F

Part of subcall function 00C12CFC: SysAllocString.OLEAUT32(?), ref: 00C12D11

Strings

`<u, xrefs: 00C12B4F

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: String$AllocVariant$ClearFreeInit
String ID: `<u
API String ID: 347726874-3367579956
Opcode ID: b09c41fec5d6859894a499c1ee1cd0669928f39ab30da1077a34968e1f32698b
Instruction ID: 049a2429d7d78785359f1bfebf71179c24a956697d419715654303447821b492
Opcode Fuzzy Hash: b09c41fec5d6859894a499c1ee1cd0669928f39ab30da1077a34968e1f32698b
Instruction Fuzzy Hash: 81213D35905219AFCB15DFA4C848FEEBBB8BF46715F104198E9129B220D730EE95DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BD97FE Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00BD988D

Strings

c:\agent\_work\66\s\src\burn\engine\condition.cpp, xrefs: 00BD982F, 00BD9870
Failed to parse condition '%ls' at position: %u, xrefs: 00BD983F
Failed to read next symbol., xrefs: 00BD98A9
Failed to find variable., xrefs: 00BD987A

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: _memcpy_s
String ID: Failed to find variable.$Failed to parse condition '%ls' at position: %u$Failed to read next symbol.$c:\agent\_work\66\s\src\burn\engine\condition.cpp
API String ID: 2001391462-1451669575
Opcode ID: b23b98537fcc9217e2f5e7ae989cbc9a7926401a2c216c0ae44a2015061aa1b0
Instruction ID: 3371f7f23b90a050cdf232b9030a1b05686532db636deab8918e65a76e9ad5ff
Opcode Fuzzy Hash: b23b98537fcc9217e2f5e7ae989cbc9a7926401a2c216c0ae44a2015061aa1b0
Instruction Fuzzy Hash: C31108339902107ADB296D689C86D97BAC5EB13F50F0001A2FD0069392EA63D950B2E1

Uniqueness

Uniqueness Score: -1.00%

Function 00BE49FF Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00C1A500,00000000,00000000,00000000,00000001,00000000,00000000,00000000,?,00BE5322), ref: 00BE4A4B

Strings

Failed to allocate message to write., xrefs: 00BE4A2A
c:\agent\_work\66\s\src\burn\engine\pipe.cpp, xrefs: 00BE4A83
Failed to write message type to pipe., xrefs: 00BE4A8D

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: FileWrite
String ID: Failed to allocate message to write.$Failed to write message type to pipe.$c:\agent\_work\66\s\src\burn\engine\pipe.cpp
API String ID: 3934441357-221464841
Opcode ID: 2b8bd6326c62f9fe328c7477050152d0a8b74a04be8e3ec9d45c398d01eb07c9
Instruction ID: 82c1150f4c423ece069ba02ba7f5b027e4481e24fd339ec3d27ba3f34ec42491
Opcode Fuzzy Hash: 2b8bd6326c62f9fe328c7477050152d0a8b74a04be8e3ec9d45c398d01eb07c9
Instruction Fuzzy Hash: 9C11B472A80169FFCB21CF96DD05ADE7BE9EF40760F1141B5B900B6250E7349E00DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00BD9DDA Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 67COMMON

Download Yara Rule

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 00BD9DFC

Strings

Failed to set variable., xrefs: 00BD9E5B
File search: %ls, did not find path: %ls, xrefs: 00BD9E67
Failed get file version., xrefs: 00BD9E3C
Failed to format path string., xrefs: 00BD9E07

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Open@16
String ID: Failed get file version.$Failed to format path string.$Failed to set variable.$File search: %ls, did not find path: %ls
API String ID: 3613110473-2458530209
Opcode ID: a8df6f27fbd2c580d4ec561d455ae318a66678827a7f458ff532113d6a291ab0
Instruction ID: c54cb0b7a2c3cfa6bc2d6554178ed640ff208557d52ddc016b0dea0abbbb3ca8
Opcode Fuzzy Hash: a8df6f27fbd2c580d4ec561d455ae318a66678827a7f458ff532113d6a291ab0
Instruction Fuzzy Hash: 33118132D00129BBDF12AA94DC82CEEFBA8DF14350B1041B6F811A6351E6319E54ABD0

Uniqueness

Uniqueness Score: -1.00%

Function 00BE80F6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00BD39DF: GetProcessHeap.KERNEL32(?,000001C7,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F0
Part of subcall function 00BD39DF: RtlAllocateHeap.NTDLL(00000000,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F7

CreateWellKnownSid.ADVAPI32(00000000,00000000,00000000,00000000,00000044,00000001,00000000,00000000,?,?,00BE8CEE,0000001A,?,?,00000000,00000000), ref: 00BE813F
GetLastError.KERNEL32(?,?,00BE8CEE,0000001A,?,?,00000000,00000000,?,?,?), ref: 00BE8149

Strings

c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 00BE811D, 00BE816D
Failed to allocate memory for well known SID., xrefs: 00BE8127
Failed to create well known SID., xrefs: 00BE8177

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Heap$AllocateCreateErrorKnownLastProcessWell
String ID: Failed to allocate memory for well known SID.$Failed to create well known SID.$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 2186923214-2807399336
Opcode ID: 19190d8f9fea76d47f64af1d4ad11006e41fdf2ff4f973bb588b07aaf090f929
Instruction ID: 0ae4917bd10df528780b0fe8fb326862bf215ddc87bdb8067f950286a07f5331
Opcode Fuzzy Hash: 19190d8f9fea76d47f64af1d4ad11006e41fdf2ff4f973bb588b07aaf090f929
Instruction Fuzzy Hash: BF014C37501B317BD2216651AC06F9FAAD8DF45F60F110066BD09BB281FF748D4291E6

Uniqueness

Uniqueness Score: -1.00%

Function 00BFDA54 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000003E8,000004FF), ref: 00BFDA82
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00BFDAAC
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,00BFDC7A,00000000,?,?,?,00000000,00000000), ref: 00BFDAB4

Strings

c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp, xrefs: 00BFDAD8
Failed while waiting for download., xrefs: 00BFDAE2

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLastMessageMultipleObjectsPeekWait
String ID: Failed while waiting for download.$c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp
API String ID: 435350009-842194682
Opcode ID: 125a8f6f6b94bfe373332c471b310e979613eb72e7fbcbac310ea5c6f7ae5d1e
Instruction ID: 8d8e9a3f2e407ac924f47e2ef3f767d2c648ecb31d168e3a873a4a60139062ca
Opcode Fuzzy Hash: 125a8f6f6b94bfe373332c471b310e979613eb72e7fbcbac310ea5c6f7ae5d1e
Instruction Fuzzy Hash: 75012533A4923977D7219AA89C49FFFBAEDEB05720F004175FB01F7181DAA4C90481E8

Uniqueness

Uniqueness Score: -1.00%

Function 00BD5F5A Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 58COMMON

Download Yara Rule

APIs

GetComputerNameW.KERNEL32(?,00000010), ref: 00BD5F88
GetLastError.KERNEL32 ref: 00BD5F92

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00BD5FB6
Failed to set variant value., xrefs: 00BD5FD9
Failed to get computer name., xrefs: 00BD5FC0

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ComputerErrorLastName
String ID: Failed to get computer name.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 3560734967-833936685
Opcode ID: 3bd7096007e941651e6b6a26f081f2aaf0fd74afeb167d3300638a7835aed865
Instruction ID: e689be108e9c15e4e3fcf23c8eb442d172c252f1e4486d10c97fd8fce7adca5a
Opcode Fuzzy Hash: 3bd7096007e941651e6b6a26f081f2aaf0fd74afeb167d3300638a7835aed865
Instruction Fuzzy Hash: C401E933A0162867D720E7659D41BDEB7E8AB09710F1100A6FD00FB381EA34ED4486E5

Uniqueness

Uniqueness Score: -1.00%

Function 00BD67C2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00BD67FB
GetLastError.KERNEL32 ref: 00BD6805

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00BD6829
Failed to set variant value., xrefs: 00BD684F
Failed to get temp path., xrefs: 00BD6833

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLastPathTemp
String ID: Failed to get temp path.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 1238063741-3623708253
Opcode ID: 8a185178e974cfe4cd0e52f99e32db68a5484820e22291c61681e83039059dda
Instruction ID: cb631ac42716fe88cb8603e6a69646e5faabb62edba7e77fff747314a6c9c90e
Opcode Fuzzy Hash: 8a185178e974cfe4cd0e52f99e32db68a5484820e22291c61681e83039059dda
Instruction Fuzzy Hash: 50016672E4123967D720A760AC06FEEB7E8AB05710F1001E6FE00FB382FA649D049AD5

Uniqueness

Uniqueness Score: -1.00%

Function 00BD5EC2 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 55COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 00BD5ED4

Part of subcall function 00C1038A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00BD5EE0,00000000), ref: 00C1039E
Part of subcall function 00C1038A: GetProcAddress.KERNEL32(00000000), ref: 00C103A5
Part of subcall function 00C1038A: GetLastError.KERNEL32(?,?,?,00BD5EE0,00000000), ref: 00C103BC

Part of subcall function 00C13578: SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 00C135A5

Strings

c:\agent\_work\66\s\src\burn\engine\variable.cpp, xrefs: 00BD5EFE
Failed to get shell folder., xrefs: 00BD5F08
Failed to set variant value., xrefs: 00BD5F38
Failed to get 64-bit folder., xrefs: 00BD5F1E

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AddressCurrentErrorFolderHandleLastModulePathProcProcess
String ID: Failed to get 64-bit folder.$Failed to get shell folder.$Failed to set variant value.$c:\agent\_work\66\s\src\burn\engine\variable.cpp
API String ID: 2084161155-2957518125
Opcode ID: 4071a8eba457b063ea5ecca707abd458c96ea63635414ab309f7df7355f102af
Instruction ID: 1b11b1a489d3fb4f65db6727f6bbc5319ce8ad4b07a7c8ced57d356fe55617f7
Opcode Fuzzy Hash: 4071a8eba457b063ea5ecca707abd458c96ea63635414ab309f7df7355f102af
Instruction Fuzzy Hash: 3A01C831954628BBDF22A790DC06FDDBAA8EF01754F1080E6F400BA251FB749E90E791

Uniqueness

Uniqueness Score: -1.00%

Function 00C102EC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,00BD4F5D,?,000000FF,?,?,?,?,?,00000000,?,?,?), ref: 00C102F8
GetLastError.KERNEL32(?,00BD4F5D,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00C10306
GetExitCodeProcess.KERNEL32(000000FF,?), ref: 00C1034B
GetLastError.KERNEL32(?,00BD4F5D,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 00C10355

Strings

c:\agent\_work\66\s\src\libs\dutil\procutil.cpp, xrefs: 00C1032A

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$CodeExitObjectProcessSingleWait
String ID: c:\agent\_work\66\s\src\libs\dutil\procutil.cpp
API String ID: 590199018-2457365779
Opcode ID: f3494457cce39882012d44681b8c3286158f2e2db11fc87cda781d117c1e8eb0
Instruction ID: 33d9ea810f277753e96203ef1b06a7d6d50300c73b1804582d1dec03cf626ad7
Opcode Fuzzy Hash: f3494457cce39882012d44681b8c3286158f2e2db11fc87cda781d117c1e8eb0
Instruction Fuzzy Hash: 90010437941136A7C7204A919C087DE7A90EF0A770F62C221FD78AF261E2B5CDC0AAD1

Uniqueness

Uniqueness Score: -1.00%

Function 00C13984 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00C13C72: FindFirstFileW.KERNEL32(00BF8F6B,?,00000100,00000000,00000000), ref: 00C13CAD
Part of subcall function 00C13C72: FindClose.KERNEL32(00000000), ref: 00C13CB9

SetFileAttributesW.KERNEL32(00BF8F6B,00000080,00000000,00BF8F6B,000000FF,00000000,?,?,00BF8F6B), ref: 00C139B3
GetLastError.KERNEL32(?,?,00BF8F6B), ref: 00C139BD
DeleteFileW.KERNEL32(00BF8F6B,00000000,00BF8F6B,000000FF,00000000,?,?,00BF8F6B), ref: 00C139DD
GetLastError.KERNEL32(?,?,00BF8F6B), ref: 00C139E7

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 00C13A02

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: File$ErrorFindLast$AttributesCloseDeleteFirst
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 3967264933-1688708105
Opcode ID: 68d2c01447f86158e18b87ba9ed1d33527afe6de5e8c6eb9c84365132cb19591
Instruction ID: 364bfa93473523ffad1a9f68df3849eb4b0c69d713f3c8bd6236d9081f768e64
Opcode Fuzzy Hash: 68d2c01447f86158e18b87ba9ed1d33527afe6de5e8c6eb9c84365132cb19591
Instruction Fuzzy Hash: CA012632A017B5A7D72247A58D05BDF7D98BF06799F014210FC55FA191D368CF80B5D0

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD6C3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00BFD6D8
LeaveCriticalSection.KERNEL32(?), ref: 00BFD71D
SetEvent.KERNEL32(?,?,?,?), ref: 00BFD731

Strings

Failed to get state during job modification., xrefs: 00BFD6F1
Failure while sending progress during BITS job modification., xrefs: 00BFD70C

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get state during job modification.$Failure while sending progress during BITS job modification.
API String ID: 3094578987-1258544340
Opcode ID: c341ce95ed81778c48f3bbde98317540bcf39e33add4676db4f0803146c9cab2
Instruction ID: b6e51a159fab88f7806bf755920ab88c5b7183ece25fb38abc4e5951ad90341f
Opcode Fuzzy Hash: c341ce95ed81778c48f3bbde98317540bcf39e33add4676db4f0803146c9cab2
Instruction Fuzzy Hash: A501F532601629FBCB02AF15D849AAEB7B8FF05324B108269F504EB651D730ED09C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD4AA Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000008,00000000,00000000,?,00BFDC04,?,?,?,?,?,00000000,00000000,?), ref: 00BFD4C4
CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00BFDC04,?,?,?,?,?,00000000,00000000,?), ref: 00BFD4CF
GetLastError.KERNEL32(?,00BFDC04,?,?,?,?,?,00000000,00000000,?), ref: 00BFD4DC

Strings

c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp, xrefs: 00BFD500
Failed to create BITS job complete event., xrefs: 00BFD50A

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CreateCriticalErrorEventInitializeLastSection
String ID: Failed to create BITS job complete event.$c:\agent\_work\66\s\src\burn\engine\bitsengine.cpp
API String ID: 3069647169-683598956
Opcode ID: a927aff93921c89333af046c8d322b96ac8801cbe2ed683e22f914460fc44d76
Instruction ID: b9da4a478aadbff329c616ab52def82bb8a9613f36088719fd79250c3a30e08c
Opcode Fuzzy Hash: a927aff93921c89333af046c8d322b96ac8801cbe2ed683e22f914460fc44d76
Instruction Fuzzy Hash: 8101B576541636ABC3109F59E805B86BBE8FF0A720B014136FE08D7B41E774E804CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00BFD936 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000008,?,00000000,00000000,00000000,?,00BFDAA2), ref: 00BFD94A
LeaveCriticalSection.KERNEL32(00000008,?,00BFDAA2), ref: 00BFD98F
SetEvent.KERNEL32(?,?,00BFDAA2), ref: 00BFD9A3

Strings

Failure while sending progress., xrefs: 00BFD97E
Failed to get BITS job state., xrefs: 00BFD963

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterEventLeave
String ID: Failed to get BITS job state.$Failure while sending progress.
API String ID: 3094578987-2876445054
Opcode ID: 8d66a49ad97b8420ad52cc75d3fdc0fa82e5e69961028f1db3758fd6212062e1
Instruction ID: d7cc1ca4d5d0a9c84305b7dac1d1ab37acb16a4d37dcbaa4f5e62600e6c8893d
Opcode Fuzzy Hash: 8d66a49ad97b8420ad52cc75d3fdc0fa82e5e69961028f1db3758fd6212062e1
Instruction Fuzzy Hash: 1A012832601628FFCB019B95D849EAEF7E8FF06720B008169F505E3640D770E908C7D5

Uniqueness

Uniqueness Score: -1.00%

Function 00BDD461 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,00BE6F37,000000B8,00000000,?,00000000,75C0B390), ref: 00BDD470
InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 00BDD47F
LeaveCriticalSection.KERNEL32(000000D0,?,00BE6F37,000000B8,00000000,?,00000000,75C0B390), ref: 00BDD494

Strings

Engine active cannot be changed because it was already in that state., xrefs: 00BDD4B7
c:\agent\_work\66\s\src\burn\engine\userexperience.cpp, xrefs: 00BDD4AD

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalSection$CompareEnterExchangeInterlockedLeave
String ID: Engine active cannot be changed because it was already in that state.$c:\agent\_work\66\s\src\burn\engine\userexperience.cpp
API String ID: 3376869089-1173769119
Opcode ID: e45e74c4c695cba65e91f852a671fc192a5c9175704f23355ccbd85c7cf224d0
Instruction ID: 5e1c8cb287b1eeabd5ecd37cbf4bc0c9b069d77ed2796b5ac92cbf4b0d45486c
Opcode Fuzzy Hash: e45e74c4c695cba65e91f852a671fc192a5c9175704f23355ccbd85c7cf224d0
Instruction Fuzzy Hash: 9BF0AF76340304BF97109EAAEC84E9BB3ECFB96765710443EF505D3381EA75F8058A60

Uniqueness

Uniqueness Score: -1.00%

Function 00C11511 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(SRSetRestorePointW,srclient.dll), ref: 00C1153C
GetLastError.KERNEL32(?,00BD4A21,00000001,?,?,00BD459E,?,?,?,?,00BD54A3,?,?,?,?), ref: 00C1154B

Strings

c:\agent\_work\66\s\src\libs\dutil\srputil.cpp, xrefs: 00C1156C
SRSetRestorePointW, xrefs: 00C11531
srclient.dll, xrefs: 00C1151A

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AddressErrorLastProc
String ID: SRSetRestorePointW$c:\agent\_work\66\s\src\libs\dutil\srputil.cpp$srclient.dll
API String ID: 199729137-2605395416
Opcode ID: 09d4ff0796b4dc43bd980f3141107e6063720874dc75f6914bc3a74eb3642275
Instruction ID: 982f7e32f02f3b2289bdf5ff0dcba99bb50c260291b8956b45e18d87be89e20f
Opcode Fuzzy Hash: 09d4ff0796b4dc43bd980f3141107e6063720874dc75f6914bc3a74eb3642275
Instruction Fuzzy Hash: 5E014973A5163293C3311395580A7DE39615F86B60F094132FF02AB362E72CCCC0B6D2

Uniqueness

Uniqueness Score: -1.00%

Function 00C04189 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00C0413A,00000000,?,00C040DA,00000000,00C37908,0000000C,00C04231,00000000,00000002), ref: 00C041A9
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00C041BC
FreeLibrary.KERNEL32(00000000,?,?,?,00C0413A,00000000,?,00C040DA,00000000,00C37908,0000000C,00C04231,00000000,00000002), ref: 00C041DF

Strings

CorExitProcess, xrefs: 00C041B4
mscoree.dll, xrefs: 00C041A2

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 30d8346a7751215b2579e0b03665aea004722a1d6ac21b0ffea112fe84ab9180
Instruction ID: 9333ff2041962e67043a9012aca7b11345b4ff3f73fd182295a626c1cc79e41d
Opcode Fuzzy Hash: 30d8346a7751215b2579e0b03665aea004722a1d6ac21b0ffea112fe84ab9180
Instruction Fuzzy Hash: 20F06271A11218BBCF159F91DC09BEEBFB5FF05761F108169FD06A21A0DB708E94CA91

Uniqueness

Uniqueness Score: -1.00%

Function 00C04682 Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00C046F4
_free.LIBCMT ref: 00C04714

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5b23515cf0e2d2396d38f2a787601c85de2d8ff333c2755960ece73a69a8758d
Instruction ID: 5859e5e07597bfec0f37b7cbb37652acc69625ce383ebfe551768f1f4606d7ab
Opcode Fuzzy Hash: 5b23515cf0e2d2396d38f2a787601c85de2d8ff333c2755960ece73a69a8758d
Instruction Fuzzy Hash: B841D676A002049FCB14DF7DC881A6EB3E5EF89310B154599E655EB391D731EE05CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00BD22B5 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(8007139F,00000000,?,?,00000000,00000000,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD22FB
GetLastError.KERNEL32(?,00000000,00000000,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD2307

Part of subcall function 00BD3C5F: GetProcessHeap.KERNEL32(00000000,000001C7,?,00BD22D5,000001C7,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD3C67
Part of subcall function 00BD3C5F: HeapSize.KERNEL32(00000000,?,00BD22D5,000001C7,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD3C6E

Strings

c:\agent\_work\66\s\src\libs\dutil\strutil.cpp, xrefs: 00BD232B

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
String ID: c:\agent\_work\66\s\src\libs\dutil\strutil.cpp
API String ID: 3662877508-792799584
Opcode ID: fff0b30a7e33acb817be4694ec774f76bfbcc154300e7b20b08b75036aa2d726
Instruction ID: dc826d574e9bfb16fd36fa846f62ea181de145619cf409c7d30c89db620c6ae9
Opcode Fuzzy Hash: fff0b30a7e33acb817be4694ec774f76bfbcc154300e7b20b08b75036aa2d726
Instruction Fuzzy Hash: E73124326002A6AFCB218F65CC84A6ABAD5EF25770B1142A6FC159B390F629CC009799

Uniqueness

Uniqueness Score: -1.00%

Function 00BD89E8 Relevance: 7.6, APIs: 5, Instructions: 117stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,00BD8BA7,00BD96F4,?,00BD96F4,?,?,00BD96F4,?,?), ref: 00BD8A08
lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,00BD8BA7,00BD96F4,?,00BD96F4,?,?,00BD96F4,?,?), ref: 00BD8A10
CompareStringW.KERNEL32(0000007F,?,?,?,?,00000000,?,00000000,00000000,?,?,00BD8BA7,00BD96F4,?,00BD96F4,?), ref: 00BD8A5F
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,00BD8BA7,00BD96F4,?,00BD96F4,?), ref: 00BD8AC1
CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,00BD8BA7,00BD96F4,?,00BD96F4,?), ref: 00BD8AEE

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CompareString$lstrlen
String ID:
API String ID: 1657112622-0
Opcode ID: 50632a81351bb35b4ca6821629fd7c3f038f961cbd17559346016d354f421a34
Instruction ID: b7cc5683908b743605fe39f226442901a5165eef8eeb3371ea23ce9bdae30676
Opcode Fuzzy Hash: 50632a81351bb35b4ca6821629fd7c3f038f961cbd17559346016d354f421a34
Instruction Fuzzy Hash: AE318572601118FFCF168F58CC84AAE7FAAEF45351F158457F90987311EA358D90DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C059AD Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000100,00000000,00C0372D,00BD3CE2,80004005,00000000,?,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7), ref: 00C059B2
_free.LIBCMT ref: 00C059E7
_free.LIBCMT ref: 00C05A0E
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 00C05A1B
SetLastError.KERNEL32(00000000,?,?,?,?,?,?,?,00000000), ref: 00C05A24

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: 9dfec25a5b0812ad305c5adbef6a1e4fbddec3054ba3b3d22513a59319125daa
Instruction ID: edb6f5de49850f9cc57ff967877f4a3d89854153fb756ef816a1f66e573b92f9
Opcode Fuzzy Hash: 9dfec25a5b0812ad305c5adbef6a1e4fbddec3054ba3b3d22513a59319125daa
Instruction Fuzzy Hash: BF017D32311F00A7CA1267396C86F7F251DEBCA3307314225F525A21E2EF308D01F921

Uniqueness

Uniqueness Score: -1.00%

Function 00BD74BE Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00BD53FA,WixBundleOriginalSource,?,?,00BEA50A,840F01E8,WixBundleOriginalSource,?,00C3AA6C,?,00000000,00BD5482,00000001,?,?,00BD5482), ref: 00BD74CA
LeaveCriticalSection.KERNEL32(00BD53FA,00BD53FA,00000000,00000000,?,?,00BEA50A,840F01E8,WixBundleOriginalSource,?,00C3AA6C,?,00000000,00BD5482,00000001,?), ref: 00BD7531

Strings

Failed to get value of variable: %ls, xrefs: 00BD7504
Failed to get value as string for variable: %ls, xrefs: 00BD7520
WixBundleOriginalSource, xrefs: 00BD74C6

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as string for variable: %ls$Failed to get value of variable: %ls$WixBundleOriginalSource
API String ID: 3168844106-30613933
Opcode ID: 4e2161228b9b22dc533dc6b2534c93c553d7a1a0123a8862bb7f898752b5d24f
Instruction ID: b20ec1e2f7bf574dae3cab25882cebf9c2a4dc3c9a9c6d85ccd5e47e76892598
Opcode Fuzzy Hash: 4e2161228b9b22dc533dc6b2534c93c553d7a1a0123a8862bb7f898752b5d24f
Instruction Fuzzy Hash: B301B132985128FBCF125F50DC09ACEBAA5EF11324F1080A5FD00AA321F735DE209BD2

Uniqueness

Uniqueness Score: -1.00%

Function 00BFCE2C Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,00000000,?,00000000,?,00BFCE24,00000000), ref: 00BFCE47
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,00BFCE24,00000000), ref: 00BFCE53
CloseHandle.KERNEL32(00C1A518,00000000,?,00000000,?,00BFCE24,00000000), ref: 00BFCE60
CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,00BFCE24,00000000), ref: 00BFCE6D
UnmapViewOfFile.KERNEL32(00C1A4E8,00000000,?,00BFCE24,00000000), ref: 00BFCE7C

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseHandle$FileUnmapView
String ID:
API String ID: 260491571-0
Opcode ID: d063cebddf1c808beca9c11f7455b7a768ae8434d4f22f02f416bce92e95745d
Instruction ID: 7b801b2cde9c829231d4e1dd2c6613f4e0ccd6b4b8676900ae2e5b1c5c7b16de
Opcode Fuzzy Hash: d063cebddf1c808beca9c11f7455b7a768ae8434d4f22f02f416bce92e95745d
Instruction Fuzzy Hash: 0401D232501B1A9FCB31AF66D98082BFBE9EF60711315C97EE29652921C371A888DE40

Uniqueness

Uniqueness Score: -1.00%

Function 00C0890A Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00C08922

Part of subcall function 00C05CE8: HeapFree.KERNEL32(00000000,00000000,?,00C089A1,?,00000000,?,00000000,?,00C089C8,?,00000007,?,?,00C08E2A,?), ref: 00C05CFE
Part of subcall function 00C05CE8: GetLastError.KERNEL32(?,?,00C089A1,?,00000000,?,00000000,?,00C089C8,?,00000007,?,?,00C08E2A,?,?), ref: 00C05D10

_free.LIBCMT ref: 00C08934
_free.LIBCMT ref: 00C08946
_free.LIBCMT ref: 00C08958
_free.LIBCMT ref: 00C0896A

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9ead5fe214cda5a1684c2fb6a5f51fd9c04a1ee6085a5123562ea1966c46602f
Instruction ID: 0e6a0b1dc13b86e0476dfff20828f2cc4c1836fffd0a5b9e47f2e1a5c20eb89d
Opcode Fuzzy Hash: 9ead5fe214cda5a1684c2fb6a5f51fd9c04a1ee6085a5123562ea1966c46602f
Instruction Fuzzy Hash: 80F0FF32654B04ABD620EB55E5C5E2B73EDFA057207A44805F194D75D1CA30FD84CA55

Uniqueness

Uniqueness Score: -1.00%

Function 00C048D1 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00C048EF

Part of subcall function 00C05CE8: HeapFree.KERNEL32(00000000,00000000,?,00C089A1,?,00000000,?,00000000,?,00C089C8,?,00000007,?,?,00C08E2A,?), ref: 00C05CFE
Part of subcall function 00C05CE8: GetLastError.KERNEL32(?,?,00C089A1,?,00000000,?,00000000,?,00C089C8,?,00000007,?,?,00C08E2A,?,?), ref: 00C05D10

_free.LIBCMT ref: 00C04901
_free.LIBCMT ref: 00C04914
_free.LIBCMT ref: 00C04925
_free.LIBCMT ref: 00C04936

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8e7e26b026e274ca9a2cd1bbea339ee67739d2622689e87d92b83e29ecae5ca6
Instruction ID: 797dce8a1ee411fe37c4673a8ce91b8913bdbcb9e9e2f79e8c4a4f07de29409e
Opcode Fuzzy Hash: 8e7e26b026e274ca9a2cd1bbea339ee67739d2622689e87d92b83e29ecae5ca6
Instruction Fuzzy Hash: CCF058B0A31B318BDA116F18FC0274E3B60FB18720325065AF264922B1CB300EA1EFC1

Uniqueness

Uniqueness Score: -1.00%

Function 00C17ED3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137timeCOMMON

Download Yara Rule

APIs

SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 00C17FE0
GetLastError.KERNEL32 ref: 00C17FEA

Strings

clbcatq.dll, xrefs: 00C17EF1, 00C17EFC
c:\agent\_work\66\s\src\libs\dutil\timeutil.cpp, xrefs: 00C1800E

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Time$ErrorFileLastSystem
String ID: c:\agent\_work\66\s\src\libs\dutil\timeutil.cpp$clbcatq.dll
API String ID: 2781989572-2453645868
Opcode ID: c616c103305e9fd69d7fa522ee8468f9ae9dfd78ba4b53a45d53bc9fa5a22667
Instruction ID: 81da5b9f99db672b0d20172e6872eb218723eb4b3cbdbfbb2fc5f28a3b1582d2
Opcode Fuzzy Hash: c616c103305e9fd69d7fa522ee8468f9ae9dfd78ba4b53a45d53bc9fa5a22667
Instruction Fuzzy Hash: 2D412336F0820A66DB20ABF88D05BFFB674AF86700F00461AB501B7280D635CF85E7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00C12F2C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(000002C0), ref: 00C12F46
SysAllocString.OLEAUT32(?), ref: 00C12F56
VariantClear.OLEAUT32(?), ref: 00C13035

Strings

c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 00C12F6E

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Variant$AllocClearInitString
String ID: c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 2213243845-3017383397
Opcode ID: 54be2a631c5eaa0548d1525a5d55fe6e7aad1dab24db0780263d34fa8cfbac03
Instruction ID: ca22760b24b5ab84fe56371141a3d9e25e2a2f48b4626dd24089e66b913b8ebd
Opcode Fuzzy Hash: 54be2a631c5eaa0548d1525a5d55fe6e7aad1dab24db0780263d34fa8cfbac03
Instruction Fuzzy Hash: 36418375900265AFCB119FA4C888EEEBBF8AF0A754F0541A5FC11EF211D735DE809BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C10708 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,00BF8B57), ref: 00C10763
RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00BF8B57,00000000), ref: 00C10781
RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000003,?,?,00BF8B57,00000000,00000000,00000000), ref: 00C107D7

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 00C107A7

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Enum$InfoQuery
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 73471667-3237223240
Opcode ID: 9f9a8dc46f7df6b466b60fbdcf23900b0fc1a905a1120c1df0a64aa2dbf73e92
Instruction ID: 835781f42b404c277e93fba5d16883a603a965fa718476bd079351f17aae9efd
Opcode Fuzzy Hash: 9f9a8dc46f7df6b466b60fbdcf23900b0fc1a905a1120c1df0a64aa2dbf73e92
Instruction Fuzzy Hash: 9C31A476901529FBEB118A94CC45EEEF7ACEF02754F214065BD00A7191E2B09EC0AAE0

Uniqueness

Uniqueness Score: -1.00%

Function 00C039BD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\adguard\setup.exe,00000104), ref: 00C039F8
_free.LIBCMT ref: 00C03AC3
_free.LIBCMT ref: 00C03ACD

Strings

C:\Users\user\AppData\Local\Temp\adguard\setup.exe, xrefs: 00C039EF, 00C039F6, 00C03A25, 00C03A5D

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\AppData\Local\Temp\adguard\setup.exe
API String ID: 2506810119-3863442885
Opcode ID: a263774e3715cf29620105918986f0b2ab133396388f534f15c38a98d3cc4bcb
Instruction ID: abf0637d974121726d24c55802b715c73440807e5d8707d9026f7a1856ee889b
Opcode Fuzzy Hash: a263774e3715cf29620105918986f0b2ab133396388f534f15c38a98d3cc4bcb
Instruction Fuzzy Hash: 62315E71B00298AFDB21DF999D85EAEBBFCEB85710B104066E94497291DB718F40EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C18B19 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 102registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C185F6: lstrlenW.KERNEL32(00000100,?,?,?,00C18996,000002C0,00000100,00000100,00000100,?,?,?,00BF7AD3,?,?,000001BC), ref: 00C1861B

RegCloseKey.ADVAPI32(00000000,00000000,crypt32.dll,00000000,00000000,00000000,00000000,crypt32.dll), ref: 00C18BFE
RegCloseKey.ADVAPI32(00000001,00000000,crypt32.dll,00000000,00000000,00000000,00000000,crypt32.dll), ref: 00C18C18

Part of subcall function 00C104A5: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,00BE05B1,?,00000000,00020006), ref: 00C104CA

Part of subcall function 00C10D87: RegSetValueExW.ADVAPI32(00020006,00C1FF38,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,00BDF2DF,00000000,?,00020006), ref: 00C10DBA

Part of subcall function 00C10D87: RegDeleteValueW.ADVAPI32(00020006,00C1FF38,00000000,?,?,00BDF2DF,00000000,?,00020006,?,00C1FF38,00020006,00000000,?,?,?), ref: 00C10DEA

Part of subcall function 00C10D39: RegSetValueExW.ADVAPI32(?,00000005,00000000,00000004,?,00000004,00000001,?,00BDF237,00C1FF38,Resume,00000005,?,00000000,00000000,00000000), ref: 00C10D4E

Strings

crypt32.dll, xrefs: 00C18B27
%ls\%ls, xrefs: 00C18B7A

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Value$Close$CreateDeletelstrlen
String ID: %ls\%ls$crypt32.dll
API String ID: 3924016894-1754266218
Opcode ID: f9bb283f9e987394733247762ae8502b59597d75ac14f6d9b892a9d8ed30496b
Instruction ID: 275ef26628b972f1c90fdc9aa6675aef56879eb0a2e397b2b772fcca870e7978
Opcode Fuzzy Hash: f9bb283f9e987394733247762ae8502b59597d75ac14f6d9b892a9d8ed30496b
Instruction Fuzzy Hash: 09311A72C0512AFFCF12AFD4CD819DEBBB9FF05750B1141A6E91072121DB319EA5ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 00BF8857 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 75registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C10823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00C3AA7C,00000000,?,00C14FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00C10837

RegCloseKey.ADVAPI32(00000000,00000000,00000088,00000000,000002C0,00000410,00020019,00000000,000002C0,00000000,?,?,?,00BF8B93,00000000,00000000), ref: 00BF8914

Strings

Failed to open uninstall key for potential related bundle: %ls, xrefs: 00BF8883
Failed to initialize package from related bundle id: %ls, xrefs: 00BF88FA
Failed to ensure there is space for related bundles., xrefs: 00BF88C7

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
API String ID: 47109696-1717420724
Opcode ID: c3f67318673890a3c47446d2b17063bddb3857aaca52269bfc220fe2d591a707
Instruction ID: 8c8dc68a37fa5d267404091bfd239c71f58dcb6e8e34af616e3b1ede44ed3dff
Opcode Fuzzy Hash: c3f67318673890a3c47446d2b17063bddb3857aaca52269bfc220fe2d591a707
Instruction Fuzzy Hash: 5921B33290021DFBDF129F94DC46BFE7BB4EF00750F1080A5FA01A6150DBB19A54EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00BD3BA1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,80004005,00000000,00000000,00000100,?,00BD146A,00000000,80004005,00000000,80004005,00000000,000001C7,?,00BD13B0), ref: 00BD3BBF
HeapReAlloc.KERNEL32(00000000,?,00BD146A,00000000,80004005,00000000,80004005,00000000,000001C7,?,00BD13B0,000001C7,00000100,?,80004005,00000000), ref: 00BD3BC6

Part of subcall function 00BD39DF: GetProcessHeap.KERNEL32(?,000001C7,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F0
Part of subcall function 00BD39DF: RtlAllocateHeap.NTDLL(00000000,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F7

Part of subcall function 00BD3C5F: GetProcessHeap.KERNEL32(00000000,000001C7,?,00BD22D5,000001C7,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD3C67
Part of subcall function 00BD3C5F: HeapSize.KERNEL32(00000000,?,00BD22D5,000001C7,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD3C6E

_memcpy_s.LIBCMT ref: 00BD3C12

Strings

c:\agent\_work\66\s\src\libs\dutil\memutil.cpp, xrefs: 00BD3C53

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Heap$Process$AllocAllocateSize_memcpy_s
String ID: c:\agent\_work\66\s\src\libs\dutil\memutil.cpp
API String ID: 3406509257-1758765531
Opcode ID: a0fac581f245cd86e375ea8f558ae809a3632d109f701e2159e3547a5ab112da
Instruction ID: 6fcb48e15bb93c9c908dbceb45f2afbe7f36d704ff318209f3faf37078f17fa0
Opcode Fuzzy Hash: a0fac581f245cd86e375ea8f558ae809a3632d109f701e2159e3547a5ab112da
Instruction Fuzzy Hash: 45115B32211219BBCB116F689C4195EBBCADF41F60B084253F804AB353F636CF109392

Uniqueness

Uniqueness Score: -1.00%

Function 00C18109 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69timeCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00C1814D
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00C18175
GetLastError.KERNEL32 ref: 00C1817F

Strings

c:\agent\_work\66\s\src\libs\dutil\inetutil.cpp, xrefs: 00C181A0

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLastTime$FileSystem
String ID: c:\agent\_work\66\s\src\libs\dutil\inetutil.cpp
API String ID: 1528435940-2024166147
Opcode ID: 0b67c9476c38cb3345b677f6172c52c9afcda812c776102aab8efb1e387789e1
Instruction ID: 87b116849c654de43d8650ce911643e9736c1a0f81bf027b2f3ca31cd433be00
Opcode Fuzzy Hash: 0b67c9476c38cb3345b677f6172c52c9afcda812c776102aab8efb1e387789e1
Instruction Fuzzy Hash: 2E11E973D01129BBE720CBA5CD44BEFB7A8AB05750F214425AE41F7240E6349D4996E1

Uniqueness

Uniqueness Score: -1.00%

Function 00C1002E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62filestringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenA.KERNEL32(00BF1074,00000000,00000000,?,?,?,00C0F8EB,00BF1074,00BF1074,?,00000000,0000FDE9,?,00BF1074,8007139F,Invalid operation for this state.), ref: 00C10040
WriteFile.KERNEL32(FFFFFFFF,00000000,00000000,?,00000000,?,?,00C0F8EB,00BF1074,00BF1074,?,00000000,0000FDE9,?,00BF1074,8007139F), ref: 00C1007C
GetLastError.KERNEL32(?,?,00C0F8EB,00BF1074,00BF1074,?,00000000,0000FDE9,?,00BF1074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 00C10086

Strings

c:\agent\_work\66\s\src\libs\dutil\logutil.cpp, xrefs: 00C100B7

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorFileLastWritelstrlen
String ID: c:\agent\_work\66\s\src\libs\dutil\logutil.cpp
API String ID: 606256338-727082060
Opcode ID: 1d6fec92184dfd40697062470bafa6ff36869cf01b98bf8272cf9e6dcce760c2
Instruction ID: 38e5d10e72acc96481e3d22dc8367251b89971be29b03c33ef69c3418ff2191a
Opcode Fuzzy Hash: 1d6fec92184dfd40697062470bafa6ff36869cf01b98bf8272cf9e6dcce760c2
Instruction Fuzzy Hash: CD11E972A01224A7C3209B768D44FEFBA68EB4B760F214215FD11E7240E6F0DDC0A6E0

Uniqueness

Uniqueness Score: -1.00%

Function 00BD1206 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,00BD527C,00000000,?), ref: 00BD1244
GetLastError.KERNEL32(?,?,?,00BD527C,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00BD124E

Strings

c:\agent\_work\66\s\src\libs\dutil\apputil.cpp, xrefs: 00BD126F
ignored , xrefs: 00BD1213

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ArgvCommandErrorLastLine
String ID: c:\agent\_work\66\s\src\libs\dutil\apputil.cpp$ignored
API String ID: 3459693003-1283515844
Opcode ID: a5e5d76f4d01813cf2613c2c7f8e9d6017ccd01819dcf435a15dfe01323842b7
Instruction ID: 902e3158636192ead219646eaaa1eda5a7d3e30d088820197c13cb02b47a1f6f
Opcode Fuzzy Hash: a5e5d76f4d01813cf2613c2c7f8e9d6017ccd01819dcf435a15dfe01323842b7
Instruction Fuzzy Hash: 8B116D76901129BB8B21DB99D905EDEFBE8EF45B50B014596F900E7311E771DE00DAA0

Uniqueness

Uniqueness Score: -1.00%

Function 00C0F6FD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00000900,?,?,00000000,00000000,00000000,?,00000000,?,?,00C0FDC0,?,?,?,?,00000001), ref: 00C0F71C
GetLastError.KERNEL32(?,00C0FDC0,?,?,?,?,00000001,?,00BD5651,?,?,00000000,?,?,00BD53D2,00000002), ref: 00C0F728
LocalFree.KERNEL32(00000000,?,?,00000000,?,?,00C0FDC0,?,?,?,?,00000001,?,00BD5651,?,?), ref: 00C0F791

Strings

c:\agent\_work\66\s\src\libs\dutil\logutil.cpp, xrefs: 00C0F747

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: c:\agent\_work\66\s\src\libs\dutil\logutil.cpp
API String ID: 1365068426-727082060
Opcode ID: 912e5cc3f42e05c8dbc75d671253691f72b945f4559f21e02c1897b384f5efe9
Instruction ID: aa82f59778c63b41dbf3109763c1244e5a125910f677d33aa1e45764d01a5d73
Opcode Fuzzy Hash: 912e5cc3f42e05c8dbc75d671253691f72b945f4559f21e02c1897b384f5efe9
Instruction Fuzzy Hash: 5911C132501229FBDF319F98CD05FEE7A69EF58750F018029FD01A61A0D7718F92E6A2

Uniqueness

Uniqueness Score: -1.00%

Function 00BFCE8D Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,00000000,74DF30D0,?,?,00BFD0C2,00000000,00000000,00000000,00000000), ref: 00BFCE9D
ReleaseMutex.KERNEL32(?,?,00BFD0C2,00000000,00000000,00000000,00000000), ref: 00BFCF24

Part of subcall function 00BD39DF: GetProcessHeap.KERNEL32(?,000001C7,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F0
Part of subcall function 00BD39DF: RtlAllocateHeap.NTDLL(00000000,?,00BD237C,?,00000001,80004005,8007139F,?,?,00C0FB39,8007139F,?,00000000,00000000,8007139F), ref: 00BD39F7

Strings

Failed to allocate memory for message data, xrefs: 00BFCEEC
c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp, xrefs: 00BFCEE2

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Heap$AllocateMutexObjectProcessReleaseSingleWait
String ID: Failed to allocate memory for message data$c:\agent\_work\66\s\src\burn\engine\netfxchainer.cpp
API String ID: 2993511968-3819074818
Opcode ID: 2eec2009c575d01675b538a4b899a99a292ac9db6a4d812abf3337f34b0da1e0
Instruction ID: dbe6e67f6bde6f2e87c2aeb665b728b065930611857c0439db4809b8efb68c1a
Opcode Fuzzy Hash: 2eec2009c575d01675b538a4b899a99a292ac9db6a4d812abf3337f34b0da1e0
Instruction Fuzzy Hash: 1C11C1B1300219AFC7159F28E891EAABBF5FF09720B1041B9F9059B7A2C731AC50CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C145C9 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(002E0032,40000000,00000001,00000000,00000002,00000080,00000000,00BE0458,00000000,?,00BDF49C,00C1A500,00000080,002E0032,00000000), ref: 00C145E1
GetLastError.KERNEL32(?,00BDF49C,00C1A500,00000080,002E0032,00000000,?,00BE0458,crypt32.dll,00000094,?,?,?,?,?,00000000), ref: 00C145EE
CloseHandle.KERNEL32(00000000,00000000,00C1A500,00BDF49C,?,00BDF49C,00C1A500,00000080,002E0032,00000000,?,00BE0458,crypt32.dll,00000094), ref: 00C14642

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 00C14612

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseCreateErrorFileHandleLast
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 2528220319-1688708105
Opcode ID: efe3d068eaa7fa77c665a135fd1f8a1cfdba3eb9d7c2557de4bd0e2b9334d6b7
Instruction ID: 6b4fa92092d8808d07b97b679665d13765ed042de6ef5c714e4c76270b25c633
Opcode Fuzzy Hash: efe3d068eaa7fa77c665a135fd1f8a1cfdba3eb9d7c2557de4bd0e2b9334d6b7
Instruction Fuzzy Hash: E0012F33642221A7DB210BA98C09FDE3A55AB43B74F024210FE21AB2E0C721CC80B2A5

Uniqueness

Uniqueness Score: -1.00%

Function 00C14199 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000080,00000001,00000000,00000003,00000080,00000000,000002C0,00000000,?,00BF89B4,00000000,00000088,000002C0,BundleCachePath,00000000), ref: 00C141CD
GetLastError.KERNEL32(?,00BF89B4,00000000,00000088,000002C0,BundleCachePath,00000000,000002C0,BundleVersion,000000B8,000002C0,EngineVersion,000002C0,000000B0), ref: 00C141DA

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 00C141AE, 00C141FE

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CreateErrorFileLast
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 1214770103-1688708105
Opcode ID: 0388e7607c00dfa9db1dd84a96b4268ba0f669b23808a5d97815b524cf4a65ad
Instruction ID: 2beb1e35f898fef76859013e4ac6ce55356685224724d4f97b22c9afbc606c0b
Opcode Fuzzy Hash: 0388e7607c00dfa9db1dd84a96b4268ba0f669b23808a5d97815b524cf4a65ad
Instruction Fuzzy Hash: EE01F933681131B7E33126949C09FEE69A8AB17F71F118161FE11BB2D1D6794DC072E5

Uniqueness

Uniqueness Score: -1.00%

Function 00BE06B6 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C10823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00C3AA7C,00000000,?,00C14FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00C10837

RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,00000001,00000000), ref: 00BE0726

Strings

Failed to update name and publisher., xrefs: 00BE0710
Failed to open registration key., xrefs: 00BE06DD
Failed to update resume mode., xrefs: 00BE06F7

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseOpen
String ID: Failed to open registration key.$Failed to update name and publisher.$Failed to update resume mode.
API String ID: 47109696-1865096027
Opcode ID: 72acb8c9d269277618463bcad5145ebda6ae803c646527d926de03aed8438985
Instruction ID: fd816a8c75b22d1bcae867a9f4317bece496d3bff2a2d3fd2e79303e2a1be118
Opcode Fuzzy Hash: 72acb8c9d269277618463bcad5145ebda6ae803c646527d926de03aed8438985
Instruction Fuzzy Hash: F801D832950239FBDF126A91DC41F9EBBB5EF01754F204091F500B6291D7B1AE90ABC0

Uniqueness

Uniqueness Score: -1.00%

Function 00C13183 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00C131C8
SysFreeString.OLEAUT32(00000000), ref: 00C131FB

Strings

`<u, xrefs: 00C131FB
c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 00C13199, 00C131DF

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: String$AllocFree
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-1301604586
Opcode ID: 531a2bb108e1c6a23cbbab41a2d4a82a432685664cd83e137f8f1a07475e8fd5
Instruction ID: 498f943ca4c9e8f04b8759493584dbb4906be93d5b905ddae7f6617a8865164b
Opcode Fuzzy Hash: 531a2bb108e1c6a23cbbab41a2d4a82a432685664cd83e137f8f1a07475e8fd5
Instruction Fuzzy Hash: DB012631244296BBEB201A554C08FFE76E9EF43B65F208036FD14E7351C678CF80A291

Uniqueness

Uniqueness Score: -1.00%

Function 00C13209 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00C1324E
SysFreeString.OLEAUT32(00000000), ref: 00C13281

Strings

`<u, xrefs: 00C13281
c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 00C1321F, 00C13265

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: String$AllocFree
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-1301604586
Opcode ID: 49cb2385828499b37f5c4f604ead56f8591857238542a717a410d45fcff7f6f3
Instruction ID: c23a4e57f8927449673c0728efc5390a00cf211d9c444f6c623739f95797b780
Opcode Fuzzy Hash: 49cb2385828499b37f5c4f604ead56f8591857238542a717a410d45fcff7f6f3
Instruction Fuzzy Hash: EA01D635641296BBDB202A959C08FFB76D8DF53BA4F104179FC14E7352C678CF406691

Uniqueness

Uniqueness Score: -1.00%

Function 00BF6951 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48serviceCOMMON

Download Yara Rule

APIs

ControlService.ADVAPI32(00BF6865,00000001,?,00000001,00000000,?,?,?,?,?,?,00BF6865,00000000), ref: 00BF6979
GetLastError.KERNEL32(?,?,?,?,?,?,00BF6865,00000000), ref: 00BF6983

Strings

c:\agent\_work\66\s\src\burn\engine\msuengine.cpp, xrefs: 00BF69A7
Failed to stop wusa service., xrefs: 00BF69B1

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ControlErrorLastService
String ID: Failed to stop wusa service.$c:\agent\_work\66\s\src\burn\engine\msuengine.cpp
API String ID: 4114567744-4214498911
Opcode ID: b08d6a4824f33838c360e8b3223b7cd4b36f718b5df64ec5a2d96a0032e716a0
Instruction ID: e12027a9d442033ac2b2bcd8e4999654506b494c4c4010ffbbe34ce28c0fdbcf
Opcode Fuzzy Hash: b08d6a4824f33838c360e8b3223b7cd4b36f718b5df64ec5a2d96a0032e716a0
Instruction Fuzzy Hash: F301F733A0013867D7209765AC45BEFB7E4EB4DB10F114165FE01BB280E974990481D5

Uniqueness

Uniqueness Score: -1.00%

Function 00C1608D Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 00C160EC

Part of subcall function 00C17ED3: SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 00C17FE0
Part of subcall function 00C17ED3: GetLastError.KERNEL32 ref: 00C17FEA

Strings

clbcatq.dll, xrefs: 00C160B9
`<u, xrefs: 00C160EC
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 00C160DA

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Time$ErrorFileFreeLastStringSystem
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp$clbcatq.dll
API String ID: 211557998-485600161
Opcode ID: 358add8d0462508b074531c3ef3993b509f2b1912325ec552520fb8decaed9b0
Instruction ID: f182a5e8fa3b84db749ed28259c8c4e84724f2bba77ec534f8778c8bc481fbb7
Opcode Fuzzy Hash: 358add8d0462508b074531c3ef3993b509f2b1912325ec552520fb8decaed9b0
Instruction Fuzzy Hash: F401A271901126FF8B209F85C9418DAFAA8FF1A764B11C1BAA60467111D3719E40F7A4

Uniqueness

Uniqueness Score: -1.00%

Function 00BEEB14 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009002,00000000,?), ref: 00BEEB3C
GetLastError.KERNEL32 ref: 00BEEB46

Strings

Failed to post elevate message., xrefs: 00BEEB74
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 00BEEB6A

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post elevate message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-3565835173
Opcode ID: 8be15d840d26ece34a5483fce3207a1294254449e18c8d56e94beb364bb71568
Instruction ID: caea3749742b731212399f8e3da0c640c9f5b3d887fbd4a0dc53023acc0d071f
Opcode Fuzzy Hash: 8be15d840d26ece34a5483fce3207a1294254449e18c8d56e94beb364bb71568
Instruction Fuzzy Hash: 65F02233A01271A7C32006A95C0AA8677C4BB05B30F1182A4FE29AF2C2E725CC0182D5

Uniqueness

Uniqueness Score: -1.00%

Function 00BDD88A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,BootstrapperApplicationDestroy), ref: 00BDD8B1
FreeLibrary.KERNEL32(?,?,00BD4920,00000000,?,?,00BD54CB,?,?), ref: 00BDD8C0
GetLastError.KERNEL32(?,00BD4920,00000000,?,?,00BD54CB,?,?), ref: 00BDD8CA

Strings

BootstrapperApplicationDestroy, xrefs: 00BDD8A9

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AddressErrorFreeLastLibraryProc
String ID: BootstrapperApplicationDestroy
API String ID: 1144718084-3186005537
Opcode ID: c8899a5a07f0bb50274716fbac9f7220593c32fa61506820f17ccc98806aa310
Instruction ID: 0a9062edc8b2f054d2e18671a19d399fafbee2bba1d45e2accdde23d6603f706
Opcode Fuzzy Hash: c8899a5a07f0bb50274716fbac9f7220593c32fa61506820f17ccc98806aa310
Instruction Fuzzy Hash: 80F0F632600626ABC7129F65D804B6AF7E8FF05762701C27AE819D7620E732EC50EBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00C12A57 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00C12A6C
SysFreeString.OLEAUT32(00000000), ref: 00C12A9C

Strings

`<u, xrefs: 00C12A9C
c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 00C12A80

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: String$AllocFree
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-1301604586
Opcode ID: 9c6c8e2512586956499efb393001f02818ebf1a884865ab9591ff92f696623ea
Instruction ID: bd08b05f681ab626a4c3005d5a9414473b6de775099124abb3cbc0e2b82cc961
Opcode Fuzzy Hash: 9c6c8e2512586956499efb393001f02818ebf1a884865ab9591ff92f696623ea
Instruction Fuzzy Hash: 20F09039202565ABC7314A019C08FAF7BA5AF82B61F148029FC1467310C7798D60BA95

Uniqueness

Uniqueness Score: -1.00%

Function 00C12CFC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00C12D11
SysFreeString.OLEAUT32(00000000), ref: 00C12D41

Strings

`<u, xrefs: 00C12D41
c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp, xrefs: 00C12D28

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: String$AllocFree
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\xmlutil.cpp
API String ID: 344208780-1301604586
Opcode ID: 69581984af29e87a5ce8fae1030ff4732463e02b7e0012991556bf4dffdc4de9
Instruction ID: 479e2929d6db7621e70f40624a7826524b142346773edd775f86ca87428df0a6
Opcode Fuzzy Hash: 69581984af29e87a5ce8fae1030ff4732463e02b7e0012991556bf4dffdc4de9
Instruction Fuzzy Hash: 35F0B439101194EBC7226F05EC08FEA7BA8EF42760F118015FC145B220C778CD60EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BEF11E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009001,00000000,?), ref: 00BEF133
GetLastError.KERNEL32 ref: 00BEF13D

Strings

Failed to post plan message., xrefs: 00BEF16B
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 00BEF161

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post plan message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-4270167399
Opcode ID: e668fbd843c102339a40fafb09ff01c41d2687c326ddb31c8b277460638dbe6c
Instruction ID: 97a728d1cf98643e012eca718b584fcb088e0581abd394386ad27b97cbe3b7bf
Opcode Fuzzy Hash: e668fbd843c102339a40fafb09ff01c41d2687c326ddb31c8b277460638dbe6c
Instruction Fuzzy Hash: 54F0AE3364123567D6205695AC05F977EC4FF06B70F124071BD18BA291E625DC0085D5

Uniqueness

Uniqueness Score: -1.00%

Function 00BEF22C Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009005,?,00000000), ref: 00BEF241
GetLastError.KERNEL32 ref: 00BEF24B

Strings

Failed to post shutdown message., xrefs: 00BEF279
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 00BEF26F

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post shutdown message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-519151043
Opcode ID: fe757c2435661f31a35769de378a128fb5c945672e417820748a01a4177c1cf9
Instruction ID: c02293df018149ea5fae933e632f300b8a9cf6043e30c4af5c6f8eb61d80abd7
Opcode Fuzzy Hash: fe757c2435661f31a35769de378a128fb5c945672e417820748a01a4177c1cf9
Instruction Fuzzy Hash: 62F0823764223667962016E66C09F9A7B84BB05B60F024075BE08AA291E625DC0086E5

Uniqueness

Uniqueness Score: -1.00%

Function 00BF0564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00C1A478,00000000,?,00BF14B9,?,00000000,?,00BDC24A,?,00BD5442,?,00BE7498,?,?,00BD5442,?), ref: 00BF056E
GetLastError.KERNEL32(?,00BF14B9,?,00000000,?,00BDC24A,?,00BD5442,?,00BE7498,?,?,00BD5442,?,00BD5482,00000001), ref: 00BF0578

Strings

Failed to set begin operation event., xrefs: 00BF05A6
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00BF059C

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorEventLast
String ID: Failed to set begin operation event.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 3848097054-3321223842
Opcode ID: 6f780b32899613e7ba7a6ba3f9ed39ddc1ba7e3ff8a8e085505887e5e1dc1b3c
Instruction ID: a407ff40c23b1ddca6134a8c85b0b8983a5b87bade0b808806fd04ad28f92920
Opcode Fuzzy Hash: 6f780b32899613e7ba7a6ba3f9ed39ddc1ba7e3ff8a8e085505887e5e1dc1b3c
Instruction Fuzzy Hash: DDF0EC3395263967832032956D05BEB76C8EF19B61B0240B5FF04FB253F669DC0456E5

Uniqueness

Uniqueness Score: -1.00%

Function 00BEEAAB Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009000,00000000,?), ref: 00BEEAC0
GetLastError.KERNEL32 ref: 00BEEACA

Strings

c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 00BEEAEE
Failed to post detect message., xrefs: 00BEEAF8

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post detect message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-2517332631
Opcode ID: 9764007f19a398534d7e9b1d0abcc57d93440b92b0356da3e95346932b6e8d4d
Instruction ID: f6559e174e7c36734ef06e678b0ee3560bad8d4c896c66f850ac1bc1af8116e4
Opcode Fuzzy Hash: 9764007f19a398534d7e9b1d0abcc57d93440b92b0356da3e95346932b6e8d4d
Instruction Fuzzy Hash: 33F0A73364163167D23016A66C09F8BBED4FF05B60F024075BE19BE291E625DC00D6E5

Uniqueness

Uniqueness Score: -1.00%

Function 00BEEA1A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34threadwindowCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00009003,00000000,?), ref: 00BEEA2F
GetLastError.KERNEL32 ref: 00BEEA39

Strings

Failed to post apply message., xrefs: 00BEEA67
c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp, xrefs: 00BEEA5D

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLastMessagePostThread
String ID: Failed to post apply message.$c:\agent\_work\66\s\src\burn\engine\engineforapplication.cpp
API String ID: 2609174426-1324423724
Opcode ID: 88effe81ac104d7cf7fa220a0a43f07297edc1557047bad437487eb3537e636b
Instruction ID: cdbe54e022f87e72e83adb3d0a9bc158bb63e0fadcdc37fc1cc7db148645186f
Opcode Fuzzy Hash: 88effe81ac104d7cf7fa220a0a43f07297edc1557047bad437487eb3537e636b
Instruction Fuzzy Hash: 0DF0A7336412356BD62116A66C09F8BBEC4FF05B60F024175BD18BA291E625DC00C6E5

Uniqueness

Uniqueness Score: -1.00%

Function 00C063C9 Relevance: 6.3, APIs: 4, Instructions: 305COMMONLIBRARYCODE

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00C06454
__alldvrm.LIBCMT ref: 00C06655
__alldvrm.LIBCMT ref: 00C06677

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: ad949144aaf5d9b16d0cabd91b61aa8499d9bd64d722724cfcb4a13481783838
Instruction ID: 39d9d1ff2c1855f7fc70dff019aad8b8a5b468e48e89daa1bb389814390ed624
Opcode Fuzzy Hash: ad949144aaf5d9b16d0cabd91b61aa8499d9bd64d722724cfcb4a13481783838
Instruction Fuzzy Hash: FFA16772A003869FDB26CF68C891BBEBBE5EF11310F1842ADE5959B3C1C6358E51CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C156B4 Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 162stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 00C15781
lstrlenW.KERNEL32(00000000), ref: 00C15799

Strings

c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp, xrefs: 00C15822

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: lstrlen
String ID: c:\agent\_work\66\s\src\libs\dutil\dlutil.cpp
API String ID: 1659193697-16760509
Opcode ID: fe8309c49f43a9e2b17018734a458f3c2591e656971e212946d0b9748b4ed2b0
Instruction ID: 6beccb9f0af14eeb185aacb255315a8956ebd29932b0d8398114a0dc2b93a4d0
Opcode Fuzzy Hash: fe8309c49f43a9e2b17018734a458f3c2591e656971e212946d0b9748b4ed2b0
Instruction Fuzzy Hash: BE51AF36D00619EBDB119FA4C884AEFBBB9EFC9750F154024F910B7250D634DD80ABE0

Uniqueness

Uniqueness Score: -1.00%

Function 00C08AD8 Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,BCE85006,00C01C3F,00000000,00000000,00C02C74,?,00C02C74,?,00000001,00C01C3F,BCE85006,00000001,00C02C74,00C02C74), ref: 00C08B25
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00C08BAE
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00C08BC0
__freea.LIBCMT ref: 00C08BC9

Part of subcall function 00C05D22: HeapAlloc.KERNEL32(00000000,?,?,?,00C01782,?,0000015D,?,?,?,?,00C02BDB,000000FF,00000000,?,?), ref: 00C05D54

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__freea
String ID:
API String ID: 573072132-0
Opcode ID: 0a389cf8a175e90c5133e58df5963df3b691f2c444c7d42835e91a6abc3ffd29
Instruction ID: 16407c6a070912d55e71a2bb87382aceb1881d08fee440e934b0e2df0267e442
Opcode Fuzzy Hash: 0a389cf8a175e90c5133e58df5963df3b691f2c444c7d42835e91a6abc3ffd29
Instruction Fuzzy Hash: 5E31EFB2A0021AABDF259F65DC45EEE7BA5EF40310F148168FC54D7290EB35CE98DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BD4FE1 Relevance: 6.1, APIs: 4, Instructions: 110COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,00000000,?,00BD558F,?,?,?,?,?,?), ref: 00BD503B
DeleteCriticalSection.KERNEL32(?,?,?,00000000,?,00BD558F,?,?,?,?,?,?), ref: 00BD504F
TlsFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00BD558F,?,?), ref: 00BD513E
DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00BD558F,?,?), ref: 00BD5145

Part of subcall function 00BD115F: LocalFree.KERNEL32(?,?,00BD4FF8,?,00000000,?,00BD558F,?,?,?,?,?,?), ref: 00BD1169

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalDeleteFreeSection$CloseHandleLocal
String ID:
API String ID: 3671900028-0
Opcode ID: a7d597d21a9c1387bb09a6b146fb2305979d4922e0347f63bb3661b5559ac921
Instruction ID: 83b1ea034482a55ca28cc155f60af290bc5ab687764a1e7bf35290c6fa2d9701
Opcode Fuzzy Hash: a7d597d21a9c1387bb09a6b146fb2305979d4922e0347f63bb3661b5559ac921
Instruction Fuzzy Hash: 5041EC71500B45ABDA71EBB5C949F9BF3ECAF14301F44486AB2AAD3251EB34F944C724

Uniqueness

Uniqueness Score: -1.00%

Function 00BD4CC9 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00BDF90C: RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,00BD4CE8,?,?,00000001), ref: 00BDF95C

CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000001,00000000,?,?,?), ref: 00BD4D4F

Strings

Failed to get current process path., xrefs: 00BD4D0D
Failed to re-launch bundle process after RunOnce: %ls, xrefs: 00BD4D39
Unable to get resume command line from the registry, xrefs: 00BD4CEE

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Close$Handle
String ID: Failed to get current process path.$Failed to re-launch bundle process after RunOnce: %ls$Unable to get resume command line from the registry
API String ID: 187904097-642631345
Opcode ID: 45edcc9962fdfcded9849312c5658bcf286948d41b885c2e8f632d9095a476de
Instruction ID: 984ca70d02d91a2f1f4b96c20b24608dadb2f8c65cfbd03537cebd3875bd7f34
Opcode Fuzzy Hash: 45edcc9962fdfcded9849312c5658bcf286948d41b885c2e8f632d9095a476de
Instruction Fuzzy Hash: 98116A71D01619BB8F22AB94D8018EEFBF9EF51710B2081B6E811B6311F7308F80EA80

Uniqueness

Uniqueness Score: -1.00%

Function 00C0815F Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,00C08303,00000000,00000000,?,00C08106,00C08303,00000000,00000000,00000000,?,00C08303,00000006,FlsSetValue), ref: 00C08191
GetLastError.KERNEL32(?,00C08106,00C08303,00000000,00000000,00000000,?,00C08303,00000006,FlsSetValue,00C31A28,FlsSetValue,00000000,00000364,?,00C059FB), ref: 00C0819D
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00C08106,00C08303,00000000,00000000,00000000,?,00C08303,00000006,FlsSetValue,00C31A28,FlsSetValue,00000000), ref: 00C081AB

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: ff5779ba981ab61d142ad39d976fa47e2b4864267818dde13053d4705b772706
Instruction ID: 6666c7cbc16f4c5e9f89a17e8ab56e5c538058e18c969536e38f6d55fe1d9626
Opcode Fuzzy Hash: ff5779ba981ab61d142ad39d976fa47e2b4864267818dde13053d4705b772706
Instruction Fuzzy Hash: 6701FC36655322ABCB214B699C44B9F7758BF06BA1B158520FD55E31C0DF30D906C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 00BD743E Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00BD744A
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00BD74B1

Strings

Failed to get value as numeric for variable: %ls, xrefs: 00BD74A0
Failed to get value of variable: %ls, xrefs: 00BD7484

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as numeric for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-4270472870
Opcode ID: f91fd879e2e60ad630441e7d10bd8af401c9bd6c6a29ac4c36abb4d6353d418c
Instruction ID: bac9086dfb4b34d4ef5fef3f639efaf5659e2c1d9c655be32a443d1aefc63c52
Opcode Fuzzy Hash: f91fd879e2e60ad630441e7d10bd8af401c9bd6c6a29ac4c36abb4d6353d418c
Instruction Fuzzy Hash: 4D01B172984128FBCF125F50CC06BDEBEA5AF11325F1081A5FD00AA321FB359E509BD4

Uniqueness

Uniqueness Score: -1.00%

Function 00BD75AD Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00BD75B9
LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 00BD7620

Strings

Failed to get value of variable: %ls, xrefs: 00BD75F3
Failed to get value as version for variable: %ls, xrefs: 00BD760F

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to get value as version for variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-1851729331
Opcode ID: cb91b901528a848ced2af39d76a91eaadd2b942fd7cc2cc2664af763cee988c0
Instruction ID: ae9a93cf072be252d67ad31447a0b8a71fe4203ef738dc1287944dd8fa0dca5b
Opcode Fuzzy Hash: cb91b901528a848ced2af39d76a91eaadd2b942fd7cc2cc2664af763cee988c0
Instruction Fuzzy Hash: A901B132995528FBCF115B44DC09ACEBBA5EF11324F1080A2FD00A6221F735DE509BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00BD753E Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00000000,00000000,00000006,?,00BD985C,00000000,?,00000000,00000000,00000000,?,00BD969D,00000000,?,00000000,00000000), ref: 00BD754A
LeaveCriticalSection.KERNEL32(00000000,00000000,00000000,00000000,?,00BD985C,00000000,?,00000000,00000000,00000000,?,00BD969D,00000000,?,00000000), ref: 00BD75A0

Strings

Failed to copy value of variable: %ls, xrefs: 00BD758F
Failed to get value of variable: %ls, xrefs: 00BD7570

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: Failed to copy value of variable: %ls$Failed to get value of variable: %ls
API String ID: 3168844106-2936390398
Opcode ID: d4797f72d5e1c6f7ce05bc7743cc2624925cc781ac1c149208e917ae62f32264
Instruction ID: c770db71caf4db69fe22c71deef6277d89bae7e43ec390eecb6dbd78e8c7a269
Opcode Fuzzy Hash: d4797f72d5e1c6f7ce05bc7743cc2624925cc781ac1c149208e917ae62f32264
Instruction Fuzzy Hash: 79F0AF72940229FBCF126F90DC05EDEBFA5EF15368F1080A1FC04A6221E735DE10AB95

Uniqueness

Uniqueness Score: -1.00%

Function 00C10517 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000), ref: 00C10692

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 00C1067F

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Close
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 3535843008-3237223240
Opcode ID: 0863404ca29d219de474ef63a214785cf69ee53e89673c4b9bc187a031a722d7
Instruction ID: 124611169a5b0e8331c8153d3a389c8f56a33aaaab1be30286b742266139d053
Opcode Fuzzy Hash: 0863404ca29d219de474ef63a214785cf69ee53e89673c4b9bc187a031a722d7
Instruction Fuzzy Hash: 3341F332D00225EFDF218A54CC047ED7AB1AB82720F358166BC24AB250D7B5CEE0FB94

Uniqueness

Uniqueness Score: -1.00%

Function 00C13FBE Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 135registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C10823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00C3AA7C,00000000,?,00C14FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00C10837

RegCloseKey.ADVAPI32(00000000,80000002,SYSTEM\CurrentControlSet\Control\Session Manager,00000003,?,?,00000000,00000101), ref: 00C1411F

Strings

SYSTEM\CurrentControlSet\Control\Session Manager, xrefs: 00C13FCF
PendingFileRenameOperations, xrefs: 00C1400F, 00C140F7

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseOpen
String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager
API String ID: 47109696-3023217399
Opcode ID: 69c62a3b85cc357b9b32bf57b44a79db9a3173b4bd3ddce9c1d70db185f90c45
Instruction ID: 08a18044c170ccc0264dd15a2ec33194a3b8681de28ae388c34cd9693cd89e63
Opcode Fuzzy Hash: 69c62a3b85cc357b9b32bf57b44a79db9a3173b4bd3ddce9c1d70db185f90c45
Instruction Fuzzy Hash: 2F41AE31E00214FBCB24DF95C9819EEBBB9EF5A701F2180A9E511A7211D7318FC1EB50

Uniqueness

Uniqueness Score: -1.00%

Function 00C1095E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00C109D4
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00C10A0C

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 00C10A48

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: QueryValue
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 3660427363-3237223240
Opcode ID: 2968abb3952788c8ff7a9c8fac6bf49e5574fd5a032fea2c064cfe2e9b62cc67
Instruction ID: 0edd6343905bc674c3941ab523e8b50b435109536167a6675ddac3c728a3c9f8
Opcode Fuzzy Hash: 2968abb3952788c8ff7a9c8fac6bf49e5574fd5a032fea2c064cfe2e9b62cc67
Instruction Fuzzy Hash: 06418231D0062AEBDB21DF94C845AEEFBB9AF01750F20856AE910A7251D7708ED1EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C008B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

___except_validate_context_record.LIBVCRUNTIME ref: 00C008E3
__IsNonwritableInCurrentImage.LIBCMT ref: 00C0099C

Strings

csm, xrefs: 00C00986

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 3480331319-1018135373
Opcode ID: 0f2cd927c3a91b5d9fb70cdcaaaaaa8f00aee7f39809a750ae1749789a0eabff
Instruction ID: c19f69518ad3648ad4960e2fd16268ba516f1078a82dc7557df33ef3f9957fff
Opcode Fuzzy Hash: 0f2cd927c3a91b5d9fb70cdcaaaaaa8f00aee7f39809a750ae1749789a0eabff
Instruction Fuzzy Hash: 8941D234E00208ABDB10DF29C894B9EBBA4BF45324F358255E8295B3D2D731EB05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00C05F23 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00C1A518,00000000,00000006,00000001,comres.dll,?,00000000,?,00000000,?,?,00000000,00000006,?,comres.dll,?), ref: 00C05FF6
GetLastError.KERNEL32 ref: 00C06012

Strings

comres.dll, xrefs: 00C05F9D, 00C05FEB, 00C06027

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide
String ID: comres.dll
API String ID: 203985260-246242247
Opcode ID: 1446b449b488f000eb50bb1903a5ad20775d814512e639a4987dc1834d4a18e5
Instruction ID: 8d7406c75b0aba5e0b31acebf086dc37783d22e9d72f53d6cc75b28028bd1391
Opcode Fuzzy Hash: 1446b449b488f000eb50bb1903a5ad20775d814512e639a4987dc1834d4a18e5
Instruction Fuzzy Hash: 2431E270A00A13ABDB219F99C984BAB7BACAF41750F140069F9248B2D0DA35CE00DFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C18705 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C185F6: lstrlenW.KERNEL32(00000100,?,?,?,00C18996,000002C0,00000100,00000100,00000100,?,?,?,00BF7AD3,?,?,000001BC), ref: 00C1861B

RegCloseKey.ADVAPI32(00000000,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,00C1A500,wininet.dll,?), ref: 00C18805
RegCloseKey.ADVAPI32(?,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,00C1A500,wininet.dll,?), ref: 00C18812

Part of subcall function 00C10823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00C3AA7C,00000000,?,00C14FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00C10837

Part of subcall function 00C10708: RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,00BF8B57), ref: 00C10763
Part of subcall function 00C10708: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00BF8B57,00000000), ref: 00C10781

Strings

wininet.dll, xrefs: 00C1877A, 00C187C7

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Close$EnumInfoOpenQuerylstrlen
String ID: wininet.dll
API String ID: 2680864210-3354682871
Opcode ID: 7cbbc62d3e8efbce76a252b07dba046b6901244dfa6247c5016804d0e37b79c0
Instruction ID: 3f112f2aec91a25e3bb6cefcf894e8c78586483f37a319d224b721c2e0047257
Opcode Fuzzy Hash: 7cbbc62d3e8efbce76a252b07dba046b6901244dfa6247c5016804d0e37b79c0
Instruction Fuzzy Hash: D1311B32C04129ABCF11AF94C9809EEFAB5EF05750B21416AF91076161DB318E94EBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00BD3ADB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00BD3B3E

Strings

crypt32.dll, xrefs: 00BD3AFB, 00BD3B3A, 00BD3B3C
wininet.dll, xrefs: 00BD3AFC

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: _memcpy_s
String ID: crypt32.dll$wininet.dll
API String ID: 2001391462-82500532
Opcode ID: 4ae1699a8e0cffef73e401e02ee7f8f13826bdea54519662f1ff0bf1fc8a425b
Instruction ID: 7ecc1434215e74e29f55fea1d2ddd7669e417719fe120e3a43cdf377eb4efba4
Opcode Fuzzy Hash: 4ae1699a8e0cffef73e401e02ee7f8f13826bdea54519662f1ff0bf1fc8a425b
Instruction Fuzzy Hash: 2D115471700219ABCF08DF19CCD599FBFA9EF45694B148066FD054B311E630EA108AE0

Uniqueness

Uniqueness Score: -1.00%

Function 00BE3A2C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C10823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00C3AA7C,00000000,?,00C14FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00C10837

RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000000,?,?,?,?,00BE3F3C,feclient.dll,?,00000000,?,?,?,00BD4B57), ref: 00BE3ACD

Part of subcall function 00C1095E: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 00C109D4
Part of subcall function 00C1095E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00C10A0C

Strings

SOFTWARE\Policies\Microsoft\Windows\Installer, xrefs: 00BE3A43
Logging, xrefs: 00BE3A5A

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer
API String ID: 1586453840-387823766
Opcode ID: 26de70789eca25b09c1262bfc1b67ebc11c0b72827dd882299337bd994307015
Instruction ID: 7043d1bf4254379fafc30007679009df8171af0422df45255cc1a5e894839a71
Opcode Fuzzy Hash: 26de70789eca25b09c1262bfc1b67ebc11c0b72827dd882299337bd994307015
Instruction Fuzzy Hash: 11112636600255BBEB24DA82D90EFFEB7E4EB00F14FA441A5E881A7190C7748FC19650

Uniqueness

Uniqueness Score: -1.00%

Function 00C10D87 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62registryCOMMON

Download Yara Rule

APIs

RegSetValueExW.ADVAPI32(00020006,00C1FF38,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,00BDF2DF,00000000,?,00020006), ref: 00C10DBA
RegDeleteValueW.ADVAPI32(00020006,00C1FF38,00000000,?,?,00BDF2DF,00000000,?,00020006,?,00C1FF38,00020006,00000000,?,?,?), ref: 00C10DEA

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 00C10E1E

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Value$Delete
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 1738766685-3237223240
Opcode ID: 92284c1cc242872527cccf009d66df414918b755ab9062b8d9068357a07e1d26
Instruction ID: e3b79aab5b22b760d8f9f0d934360eba5e33a12251a78cd1fc2d0a74a8f479f5
Opcode Fuzzy Hash: 92284c1cc242872527cccf009d66df414918b755ab9062b8d9068357a07e1d26
Instruction Fuzzy Hash: 7511063394113AB7DB215A958D05BEFBA61EF06760F314520FE10BA190D6B0DED0B7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00BDDD59 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CompareStringW.KERNEL32(00000000,00000000,00000000,000000FF,?,000000FF,IGNOREDEPENDENCIES,00000000,?,?,00BF73ED,00000000,IGNOREDEPENDENCIES,00000000,?,00C1A518), ref: 00BDDDAA

Strings

Failed to copy the property value., xrefs: 00BDDDDE
IGNOREDEPENDENCIES, xrefs: 00BDDD61

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CompareString
String ID: Failed to copy the property value.$IGNOREDEPENDENCIES
API String ID: 1825529933-1412343224
Opcode ID: b09a5b81e1edca3de6b0473777b00aca067fb21497a60e7c376fa6ded1897073
Instruction ID: e2f920609d59a70a89e5fad5dddda2d99da43786cea87f126f0c1c36f94211cf
Opcode Fuzzy Hash: b09a5b81e1edca3de6b0473777b00aca067fb21497a60e7c376fa6ded1897073
Instruction Fuzzy Hash: A9117332204215AFDF118F54CC85FA9F7E6EF05325F2541BBFA589B391EB709850CA90

Uniqueness

Uniqueness Score: -1.00%

Function 00BD1578 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

LCMapStringW.KERNEL32(0000007F,00000000,00000000,00BE6FDF,00000000,00BE6FDF,00000000,00000000,00BE6FDF,00000000,00000000,00000000,?,00BD2420,00000000,00000000), ref: 00BD15BC
GetLastError.KERNEL32(?,00BD2420,00000000,00000000,00BE6FDF,00000200,?,00C14ABC,00000000,00BE6FDF,00000000,00BE6FDF,00000000,00000000,00000000), ref: 00BD15C6

Strings

c:\agent\_work\66\s\src\libs\dutil\strutil.cpp, xrefs: 00BD15EA

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorLastString
String ID: c:\agent\_work\66\s\src\libs\dutil\strutil.cpp
API String ID: 3728238275-792799584
Opcode ID: bf19fd6f1b178fa36fa3186a44dd49d184f1ba971434d78dae811b3825f22b9d
Instruction ID: 58de2f06f3d9fe9d148bd3656bcd07755788c98072b46ab9818f139f10051066
Opcode Fuzzy Hash: bf19fd6f1b178fa36fa3186a44dd49d184f1ba971434d78dae811b3825f22b9d
Instruction Fuzzy Hash: 0001F933942676778B218A996C00E9BFAD8FF96B70B014552FE14AB341E625DC1087E1

Uniqueness

Uniqueness Score: -1.00%

Function 00BE573C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000000), ref: 00BE5759
CoUninitialize.OLE32(?,00000000,?,?,?,?,?,?,?), ref: 00BE57B2

Strings

Failed to initialize COM on cache thread., xrefs: 00BE576E

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: InitializeUninitialize
String ID: Failed to initialize COM on cache thread.
API String ID: 3442037557-3629645316
Opcode ID: 510e5ddc094f66ba2a9a0f854c64789e763e13cf747fa14ed8129b974d809d4b
Instruction ID: fa094ffed77c43ad15847f3209441408022d6d657c305e50ea3293f1355a1a47
Opcode Fuzzy Hash: 510e5ddc094f66ba2a9a0f854c64789e763e13cf747fa14ed8129b974d809d4b
Instruction Fuzzy Hash: CA01A172600619FFDB058B95EC84EEAFBEDFF09354B008169F50997220EB70AD50CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C14E42 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(20000004,00000000,00000000,00000000,00000000,00000000,?,?,00BE8D6E,?,00000001,20000004,00000000,00000000,?,00000000), ref: 00C14E71
SetNamedSecurityInfoW.ADVAPI32(00000000,?,000007D0,00000003,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00BE8D6E,?), ref: 00C14E8C

Strings

c:\agent\_work\66\s\src\libs\dutil\aclutil.cpp, xrefs: 00C14EB0

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: InfoNamedSecuritySleep
String ID: c:\agent\_work\66\s\src\libs\dutil\aclutil.cpp
API String ID: 2352087905-2024494872
Opcode ID: e91c7cfdbfebf969271c49fc567dbd66506739fb44d2fde70ae5cbe19e650fb6
Instruction ID: 19837d7e0fb0a31383e08f27713e86733e1940da8174c8caadbcd10bd77e7031
Opcode Fuzzy Hash: e91c7cfdbfebf969271c49fc567dbd66506739fb44d2fde70ae5cbe19e650fb6
Instruction Fuzzy Hash: F8015E33801129FBCF229F94CD05ADEBEA6FF86B61F124155FD1466250C2359E90ABD0

Uniqueness

Uniqueness Score: -1.00%

Function 00BD5160 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,00BD1104,?,?,00000000), ref: 00BD517F
CompareStringW.KERNEL32(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,00BD1104,?,?,00000000), ref: 00BD51AF

Strings

burn.clean.room, xrefs: 00BD516C, 00BD5179, 00BD51A6

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CompareStringlstrlen
String ID: burn.clean.room
API String ID: 1433953587-3055529264
Opcode ID: 4cb6cdd9a51620855a8315d0fe88eaf53e1db3e39d8dc3abcc8710f42ddf8941
Instruction ID: 5efc66d6475a9c1bbed8ca82dcb295f114a1a8910d895748b3252ee1f8012742
Opcode Fuzzy Hash: 4cb6cdd9a51620855a8315d0fe88eaf53e1db3e39d8dc3abcc8710f42ddf8941
Instruction Fuzzy Hash: DC01D676520A20AB97304B49AD84FBBFBECEB1D7507104117F544D3710E3619CA0DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00C13448 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00C10823: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00C3AA7C,00000000,?,00C14FE0,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000), ref: 00C10837

RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,00C132E8,?), ref: 00C134B9

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 00C13463
EnableLUA, xrefs: 00C1348B

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CloseOpen
String ID: EnableLUA$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
API String ID: 47109696-3551287084
Opcode ID: ed6f213b924acaa6ae55d48f3abfad5a767b6884c423fdae4c6e51c2a3bcc5a7
Instruction ID: 9bc6f82514e3cb9eb6736943be1250e64478316c79ace48a25740ca14dde8698
Opcode Fuzzy Hash: ed6f213b924acaa6ae55d48f3abfad5a767b6884c423fdae4c6e51c2a3bcc5a7
Instruction Fuzzy Hash: 1E018F32C11228FBD712AAA4C90ABDDFAA8AB05729F204164BD01B7051D3B85FC4E7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00C160FB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00C16160

Strings

`<u, xrefs: 00C16160
c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp, xrefs: 00C1611C

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: FreeString
String ID: `<u$c:\agent\_work\66\s\src\libs\dutil\atomutil.cpp
API String ID: 3341692771-3052637621
Opcode ID: c012b022ab07acca09bcaabb925fa6715d3c7a2938f704d158f174fb6ff42f1e
Instruction ID: 983148d6242d8ffaefbf8ea9bad35a4af87df94be33db0531ce71e8590ccd9b9
Opcode Fuzzy Hash: c012b022ab07acca09bcaabb925fa6715d3c7a2938f704d158f174fb6ff42f1e
Instruction Fuzzy Hash: 0E01F436800115FBCB2167458D06FEEFBB8AF43B60F314156B91076252D3748F80F6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00BD34C4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,00BD10DD,?,00000000), ref: 00BD34E5
GetLastError.KERNEL32(?,?,?,?,00BD10DD,?,00000000), ref: 00BD34FC

Strings

c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp, xrefs: 00BD3520

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: c:\agent\_work\66\s\src\libs\dutil\pathutil.cpp
API String ID: 2776309574-4168559387
Opcode ID: 64f77bb43b66ffb8ed209d2a579fff3a1ca9520add5d5ca8f73d94bb5f2e0df2
Instruction ID: aabb5e82ed46e182bfe473f5a3f35409d9b468659bf0da6a9b47eff6d3c82a80
Opcode Fuzzy Hash: 64f77bb43b66ffb8ed209d2a579fff3a1ca9520add5d5ca8f73d94bb5f2e0df2
Instruction Fuzzy Hash: 77F02833A0113173872246956C44E8BFBD8EB51FA0B0641A3FD04AB302F62ACE0086E2

Uniqueness

Uniqueness Score: -1.00%

Function 00BD6540 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?), ref: 00BD6552

Part of subcall function 00C1038A: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,00BD5EE0,00000000), ref: 00C1039E
Part of subcall function 00C1038A: GetProcAddress.KERNEL32(00000000), ref: 00C103A5
Part of subcall function 00C1038A: GetLastError.KERNEL32(?,?,?,00BD5EE0,00000000), ref: 00C103BC

Part of subcall function 00BD5D14: RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 00BD5D9A

Strings

Failed to set variant value., xrefs: 00BD658F
Failed to get 64-bit folder., xrefs: 00BD6575

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AddressCloseCurrentErrorHandleLastModuleProcProcess
String ID: Failed to get 64-bit folder.$Failed to set variant value.
API String ID: 3109562764-2681622189
Opcode ID: 0231de5ba67374761cf7641f86ca365ca114f4046f85ac64fa9c0712468947e9
Instruction ID: 08a7b209bd0e6eb61b7efc0e596e8afe4ac44e0faeabe560dc2e0a778c631b42
Opcode Fuzzy Hash: 0231de5ba67374761cf7641f86ca365ca114f4046f85ac64fa9c0712468947e9
Instruction Fuzzy Hash: 7E016732910628FBCF11A790EC05EDEBBB8EF15715F204197B40066255E771AF90EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00BFDFDF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00BFE902

Part of subcall function 00C00AD1: RaiseException.KERNEL32(?,?,?,00BFE924,?,00000000,00000000,?,?,?,?,?,00BFE924,?,00C378A8), ref: 00C00B31

__CxxThrowException@8.LIBVCRUNTIME ref: 00BFE91F

Strings

Unknown exception, xrefs: 00BFE92C

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Unknown exception
API String ID: 3476068407-410509341
Opcode ID: 9cb0ba093042a3f278fce67d2b0136d78d063f3fec37e8b6612ebda4a36ed5e1
Instruction ID: 11e4d5f45447b64ab6bacb0c303c6b9b418be0ea607183caee2d202e4df2f150
Opcode Fuzzy Hash: 9cb0ba093042a3f278fce67d2b0136d78d063f3fec37e8b6612ebda4a36ed5e1
Instruction Fuzzy Hash: 44F0C87490430D77CF24BAA9DC5697D33AC9A00350F6046B5FB25A30F1EB70E91DD191

Uniqueness

Uniqueness Score: -1.00%

Function 00C14224 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetFileSizeEx.KERNEL32(00000000,00000000,00000000,74DF34C0,?,?,?,00BDB9EC,?,?,?,00000000,00000000), ref: 00C1423C
GetLastError.KERNEL32(?,?,?,00BDB9EC,?,?,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 00C14246

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 00C1426A

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: ErrorFileLastSize
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 464720113-1688708105
Opcode ID: 54469bb2792743604d0ebc38991e651f1d0f908bb390df6af1455d7cb534451d
Instruction ID: 037ce98bb4f441fd39c20f803cfa908048f22181845bda3f218ace09c8e5d867
Opcode Fuzzy Hash: 54469bb2792743604d0ebc38991e651f1d0f908bb390df6af1455d7cb534451d
Instruction Fuzzy Hash: 4BF0AFB2901226AB97148B85C905A9EFBACEF56B60B028116BC58A7341E374AD80D7E0

Uniqueness

Uniqueness Score: -1.00%

Function 00C135D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35comCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(Microsoft.Update.AutoUpdate,00BD54A3,?,00000000,00BD54A3,?,?,?), ref: 00C135FE
CoCreateInstance.OLE32(00000000,00000000,00000001,00C36B4C,?), ref: 00C13616

Strings

Microsoft.Update.AutoUpdate, xrefs: 00C135F9

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID: Microsoft.Update.AutoUpdate
API String ID: 2151042543-675569418
Opcode ID: c9bbde7901fa0a80dc7fbc74b0f2c22ff8cd199afd92d93fed397a274a413b44
Instruction ID: c736fa2cc67b160687d66f6deb3c5e7770cbb9a3e26e42d7135acf7977df9f58
Opcode Fuzzy Hash: c9bbde7901fa0a80dc7fbc74b0f2c22ff8cd199afd92d93fed397a274a413b44
Instruction Fuzzy Hash: 8DF05E75610208BBEB00EBA8DD46BEFB7B8EB49710F504035EA01E7191D670EA088A62

Uniqueness

Uniqueness Score: -1.00%

Function 00C106C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 18libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 00C106E1

Strings

RegDeleteKeyExW, xrefs: 00C106D6
AdvApi32.dll, xrefs: 00C106C6

Memory Dump Source

Source File: 00000001.00000002.4129005692.0000000000BD1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BD0000, based on PE: true

Associated: 00000001.00000002.4128945844.0000000000BD0000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129109791.0000000000C1A000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129179566.0000000000C3A000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C3D000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C47000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000001.00000002.4129240076.0000000000C56000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_bd0000_setup.jbxd

Similarity

API ID: AddressProc
String ID: AdvApi32.dll$RegDeleteKeyExW
API String ID: 190572456-850864035
Opcode ID: d95f8c219e30dc91b1524d9d8889821df66fc32397dfb3aa8f00968eb4833d71
Instruction ID: c5e9b077b5fa65c514fc33ee155ad95167dd738c3ad56c54c8cfb10cf2972d8a
Opcode Fuzzy Hash: d95f8c219e30dc91b1524d9d8889821df66fc32397dfb3aa8f00968eb4833d71
Instruction Fuzzy Hash: C1E08C70632A219BD3045F14BC4679D3AB0BB05B24F000120F6059A272D7B24CC8AB84

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: setup.exePID: 7228, Parent PID: 7204COMMON

Executed Functions

Function 001E1070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 73fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001E34C4: GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 001E34E5

CreateFileW.KERNEL32(?,80000000,00000005,00000000), ref: 001E10F6
CloseHandle.KERNEL32(00000000), ref: 001E1131

Strings

crypt32.dll, xrefs: 001E10CA
comres.dll, xrefs: 001E10B5
version.dll, xrefs: 001E10A7
cabinet.dll, xrefs: 001E1099
msasn1.dll, xrefs: 001E10C3
msi.dll, xrefs: 001E10A0
clbcatq.dll, xrefs: 001E10BC
feclient.dll, xrefs: 001E10D1
wininet.dll, xrefs: 001E10AE

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: File$CloseCreateHandleModuleName
String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
API String ID: 2106025501-3151496603
Opcode ID: 7d2a3f123366b52f019c244a651e6d7201f0bd1479af986fec3035a4819515db
Instruction ID: 58ceb24b0ab77a1f0a1008b4a69b4bc700d22af58bd88555d3f8fa9baed6d702
Opcode Fuzzy Hash: 7d2a3f123366b52f019c244a651e6d7201f0bd1479af986fec3035a4819515db
Instruction Fuzzy Hash: 60218E71910668BBCB10AFA5ED09BEFBBB8AF49714F504114EA11B7280D7B09914CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06DDC9A0 Relevance: 2.6, Strings: 2, Instructions: 149COMMON

Download Yara Rule

Strings

4'dq, xrefs: 06DDCA6A
4'dq, xrefs: 06DDCA3F

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID: 4'dq$4'dq
API String ID: 0-2306408947
Opcode ID: 8a40bb9939b8e507b989076652dfa1f7a942a295e19b2402e2aa0ec02bf50655
Instruction ID: 8153099c66357c7c5c6568e10dccb3f3859f1f5939a708d8af602a21df6d19c7
Opcode Fuzzy Hash: 8a40bb9939b8e507b989076652dfa1f7a942a295e19b2402e2aa0ec02bf50655
Instruction Fuzzy Hash: BF514B70A50206CFD708EF6AE95069A7BF3FFC9700B14C52AC504AB268EF745D06CB61

Uniqueness

Uniqueness Score: -1.00%

Function 001EB45A Relevance: 91.6, APIs: 24, Strings: 28, Instructions: 577
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32(?,?,?,?,76EEC3F0,00000000), ref: 001EB4D1
SetFilePointerEx.KERNEL32(000000FF,00000000,00000000,00000000,00000000,?,?,?,?,76EEC3F0,00000000), ref: 001EB51F
GetLastError.KERNEL32(?,?,?,?,76EEC3F0,00000000), ref: 001EB525
ReadFile.KERNEL32(?,?,00000040,?,00000000,?,?,?,?,76EEC3F0,00000000), ref: 001EB56D
GetLastError.KERNEL32(?,?,?,?,76EEC3F0,00000000), ref: 001EB573
SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,76EEC3F0,00000000), ref: 001EB5D0
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,?,76EEC3F0,00000000), ref: 001EB5D6
ReadFile.KERNEL32(?,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,?,76EEC3F0,00000000), ref: 001EB61F
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,?,76EEC3F0,00000000), ref: 001EB625
SetFilePointerEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,?,?,?,?,76EEC3F0,00000000), ref: 001EB696
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,?,76EEC3F0,00000000), ref: 001EB69C
ReadFile.KERNEL32(?,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,?,76EEC3F0,00000000), ref: 001EB6E5
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,?,76EEC3F0,00000000), ref: 001EB6EB
ReadFile.KERNEL32(?,?,00000004,00000018,00000000,?,00000000,00000000,?,?,?,?,76EEC3F0,00000000), ref: 001EB734
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,?,76EEC3F0,00000000), ref: 001EB73A
SetFilePointerEx.KERNEL32(?,?,00000000,00000000,00000000,?,00000000,00000000,?,?,?,?,76EEC3F0,00000000), ref: 001EB786
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,?,76EEC3F0,00000000), ref: 001EB78C

Part of subcall function 001E39DF: GetProcessHeap.KERNEL32(?,000001C7,?,001E237C,?,00000001,80004005,8007139F,?,?,0021FB39,8007139F,?,00000000,00000000,8007139F), ref: 001E39F0
Part of subcall function 001E39DF: RtlAllocateHeap.NTDLL(00000000,?,001E237C,?,00000001,80004005,8007139F,?,?,0021FB39,8007139F,?,00000000,00000000,8007139F), ref: 001E39F7

ReadFile.KERNEL32(?,?,00000028,00000018,00000000,?,00000000,00000000,?,?,?,?,76EEC3F0,00000000), ref: 001EB7DF
ReadFile.KERNEL32(?,?,00000028,00000028,00000000,?,00000000,00000000,?,?,?,?,76EEC3F0,00000000), ref: 001EB841
SetFilePointerEx.KERNEL32(?,?,00000000,00000000,00000000,00000034,00000001,?,00000000,00000000,?,?,?,?,76EEC3F0,00000000), ref: 001EB8CB
GetLastError.KERNEL32(?,00000000,00000000,?,?,?,?,76EEC3F0,00000000), ref: 001EB8D5

Strings

Failed to seek to NT header., xrefs: 001EB601
Failed to seek to start of file., xrefs: 001EB550
Failed to read section info., xrefs: 001EB968
PE Header from file didn't match PE Header in memory., xrefs: 001EBAE0
Failed to find valid DOS image header in buffer., xrefs: 001EBBBA
burn, xrefs: 001EB807
Failed to open handle to engine process path., xrefs: 001EB4FC
Failed to read complete section info., xrefs: 001EB994
Failed to allocate buffer for section info., xrefs: 001EB8B3
(, xrefs: 001EB7EC
Failed to read section info, data to short: %u, xrefs: 001EB879
Failed to get total size of bundle., xrefs: 001EB9F2
Failed to find Burn section., xrefs: 001EBB01
Failed to read section info, unsupported version: %08x, xrefs: 001EB9C4
Failed to allocate memory for container sizes., xrefs: 001EBAA2
PE, xrefs: 001EB667
Failed to read DOS header., xrefs: 001EB59E
Failed to read signature offset., xrefs: 001EB716
c:\agent\_work\66\s\src\burn\engine\section.cpp, xrefs: 001EB4F2, 001EB546, 001EB594, 001EB5F7, 001EB646, 001EB6BD, 001EB70C, 001EB75B, 001EB7B0, 001EB867, 001EB8A7, 001EB8F9, 001EB95E, 001EB988, 001EB9AF, 001EBA96, 001EBAD6, 001EBAF5, 001EBB32, 001EBB70, 001EBB93, 001EBBAE
Failed to seek to section info., xrefs: 001EB6C7, 001EB903
Failed to read image section header, index: %u, xrefs: 001EBB7B
4, xrefs: 001EB853
Failed to find valid NT image header in buffer., xrefs: 001EBB9F
Failed to read NT header., xrefs: 001EB650
.wix, xrefs: 001EB7FF
Failed to seek past optional headers., xrefs: 001EB7BA
Failed to read complete image section header, index: %u, xrefs: 001EBB44
Failed to read signature size., xrefs: 001EB765

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: File$ErrorLast$Read$Pointer$Heap$AllocateProcess
String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$burn$c:\agent\_work\66\s\src\burn\engine\section.cpp
API String ID: 3411815225-1671293494
Opcode ID: ff84ddfb46f859ba435b30e9c95a6dcaa36a02d8791282e908fc652b04a0ffcf
Instruction ID: b9caf2d53371ddde06b6f78b6777023c172c1cb99504e8b57178f4caa0958499
Opcode Fuzzy Hash: ff84ddfb46f859ba435b30e9c95a6dcaa36a02d8791282e908fc652b04a0ffcf
Instruction Fuzzy Hash: C2122572D54A75BBDB348A568D8AFAF76A4BF01B10F0102A5FE05BB280D7749D40CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 001EA3D4 Relevance: 44.1, APIs: 8, Strings: 17, Instructions: 311
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_MREFOpen@16.MSPDB140-MSVCRT ref: 001EA418
_MREFOpen@16.MSPDB140-MSVCRT ref: 001EA440
RegCloseKey.ADVAPI32(00000000,?,?,?,?,?), ref: 001EA73F

Strings

Failed to allocate string buffer., xrefs: 001EA633
Failed to query registry key value., xrefs: 001EA5A4
Failed to set variable., xrefs: 001EA701
Registry value not found. Key = '%ls', Value = '%ls', xrefs: 001EA4E2
Failed to change value type., xrefs: 001EA6E3, 001EA706
Registry key not found. Key = '%ls', xrefs: 001EA478
Failed to format value string., xrefs: 001EA44D
Failed to allocate memory registry value., xrefs: 001EA54F
Failed to format key string., xrefs: 001EA425
Failed to clear variable., xrefs: 001EA49E
RegistrySearchValue failed: ID '%ls', HRESULT 0x%x, xrefs: 001EA717
Failed to read registry value., xrefs: 001EA6C8
Failed to open registry key., xrefs: 001EA4B3
Failed to get expand environment string., xrefs: 001EA6AD
Unsupported registry key value type. Type = '%u', xrefs: 001EA5D2
c:\agent\_work\66\s\src\burn\engine\search.cpp, xrefs: 001EA510, 001EA545, 001EA598, 001EA6A1
Failed to query registry key value size., xrefs: 001EA51C

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: Open@16$Close
String ID: Failed to allocate memory registry value.$Failed to allocate string buffer.$Failed to change value type.$Failed to clear variable.$Failed to format key string.$Failed to format value string.$Failed to get expand environment string.$Failed to open registry key.$Failed to query registry key value size.$Failed to query registry key value.$Failed to read registry value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchValue failed: ID '%ls', HRESULT 0x%x$Unsupported registry key value type. Type = '%u'$c:\agent\_work\66\s\src\burn\engine\search.cpp
API String ID: 2348241696-2754605460
Opcode ID: d12a821e9d09501861bf20d94521ca90edc99bf0826cfc8ecd113dd0ab112e0d
Instruction ID: eb8bcb04db5b9f6f0aa4835908094eb3ef026c6fca2cb7bb35313a1f4e38ddf7
Opcode Fuzzy Hash: d12a821e9d09501861bf20d94521ca90edc99bf0826cfc8ecd113dd0ab112e0d
Instruction Fuzzy Hash: E9A12632D00965BBCF119AE5DC45EEEBAB9AF08710F558121F901F7290D771AE109BE2

Uniqueness

Uniqueness Score: -1.00%

Function 001E51D2 Relevance: 40.6, APIs: 5, Strings: 18, Instructions: 314
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 001E5254

Part of subcall function 0021FDC4: InitializeCriticalSection.KERNEL32(0024B5D4,?,001E5260,00000000), ref: 0021FDDB

Part of subcall function 001E1206: CommandLineToArgvW.SHELL32(?,?,?,?,00000000,?,ignored ,00000000), ref: 001E1244
Part of subcall function 001E1206: GetLastError.KERNEL32 ref: 001E124E

CoInitializeEx.OLE32(00000000,00000000,00000003,00000000,00000000), ref: 001E52C2

Part of subcall function 002206C0: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 002206E1

GetVersionExW.KERNEL32(?), ref: 001E5354
GetLastError.KERNEL32 ref: 001E535E
CoUninitialize.OLE32(?,?,?), ref: 001E55CB

Strings

Failed to parse command line., xrefs: 001E5282
Failed to get OS info., xrefs: 001E538C
Failed to run per-user mode., xrefs: 001E54D1
Failed to initialize XML util., xrefs: 001E5336
Failed to initialize core., xrefs: 001E5400
@, xrefs: 001E5532
Failed to run untrusted mode., xrefs: 001E54F3
Failed to run RunOnce mode., xrefs: 001E5459
3.11.2.4516, xrefs: 001E53C1
Failed to initialize engine state., xrefs: 001E52A9
Invalid run mode., xrefs: 001E5436
Failed to initialize Wiutil., xrefs: 001E531E
Failed to initialize COM., xrefs: 001E52CE
Failed to initialize Cryputil., xrefs: 001E52E3
Failed to run per-machine mode., xrefs: 001E54A9
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 001E5382
Failed to initialize Regutil., xrefs: 001E5306
Failed to run embedded mode., xrefs: 001E5481

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
String ID: 3.11.2.4516$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$c:\agent\_work\66\s\src\burn\engine\engine.cpp$@
API String ID: 3262001429-4222581132
Opcode ID: c368f07add13439990368560eef7bbc03a91bc7b5a8187ff09e16564ab4a4255
Instruction ID: f11ae8fe243858588d33286e9bab6635db3ae1f8308b1c79f4cf0da8ba208aaa
Opcode Fuzzy Hash: c368f07add13439990368560eef7bbc03a91bc7b5a8187ff09e16564ab4a4255
Instruction Fuzzy Hash: 34B1E671D10EB9ABDB32AFA69D45BED76B6AF15304F0101E5F908B6241DB308E90CF91

Uniqueness

Uniqueness Score: -1.00%

Function 001F741D Relevance: 37.0, APIs: 1, Strings: 20, Instructions: 290
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Failed to parse command line., xrefs: 001F755A
Failed to initialize internal cache functionality., xrefs: 001F7692
WixBundleElevated, xrefs: 001F7598, 001F75A9
WixBundleSourceProcessFolder, xrefs: 001F7627
Failed to get manifest stream from container., xrefs: 001F74BF
WixBundleUILevel, xrefs: 001F75C9, 001F75DA
Failed to extract bootstrapper application payloads., xrefs: 001F76E2
Failed to load catalog files., xrefs: 001F7702
WixBundleOriginalSource, xrefs: 001F764C
Failed to get source process folder from path., xrefs: 001F7618
Failed to get unique temporary folder for bootstrapper application., xrefs: 001F76C1
Failed to overwrite the %ls built-in variable., xrefs: 001F75AE
Failed to set source process path variable., xrefs: 001F75FC
WixBundleSourceProcessPath, xrefs: 001F75EB
Failed to set source process folder variable., xrefs: 001F7638
Failed to initialize variables., xrefs: 001F7464
Failed to open manifest stream., xrefs: 001F749E
Failed to load manifest., xrefs: 001F74DB
Failed to set original source variable., xrefs: 001F765D
Failed to open attached UX container., xrefs: 001F7481

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleUILevel
API String ID: 32694325-1564579409
Opcode ID: 79a0ca70967de9b7070231404aeacf32163225e631a478a4841400925000461a
Instruction ID: 5d6f3dc1edbe599835dac999ba189635d5a46a3b0047d5daea1c3dad0606db29
Opcode Fuzzy Hash: 79a0ca70967de9b7070231404aeacf32163225e631a478a4841400925000461a
Instruction Fuzzy Hash: A1A184B2E54A5ABADB17EAA4CC45EFEB76CBB14710F010266F605E7181D730AA508BD0

Uniqueness

Uniqueness Score: -1.00%

Function 001E762D Relevance: 34.9, APIs: 1, Strings: 22, Instructions: 419
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(001F745E,001E53FA,00000000,001E5482), ref: 001E764D

Strings

$, xrefs: 001E7D4A
#, xrefs: 001E76CC
WixBundleActiveParent, xrefs: 001E7E63
WixBundleInstalled, xrefs: 001E7E2B
InstallerName, xrefs: 001E7813
WixBundleSourceProcessFolder, xrefs: 001E7E9F
WixBundleElevated, xrefs: 001E7E47
WixBundleProviderKey, xrefs: 001E7E7F
InstallerVersion, xrefs: 001E7834
Failed to add built-in variable: %ls., xrefs: 001E7F1A
WixBundleForcedRestartPackage, xrefs: 001E7E15
WixBundleUILevel, xrefs: 001E7EBF
Date, xrefs: 001E7771
WixBundleExecutePackageAction, xrefs: 001E7DF9
WixBundleAction, xrefs: 001E7D77
WixBundleSourceProcessPath, xrefs: 001E7E8F
WixBundleVersion, xrefs: 001E7ECF
LogonUser, xrefs: 001E7883
WixBundleExecutePackageCacheFolder, xrefs: 001E7D99
0, xrefs: 001E7664
', xrefs: 001E78EC
WixBundleTag, xrefs: 001E7EAF

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: CriticalInitializeSection
String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleUILevel$WixBundleVersion
API String ID: 32694325-3635313340
Opcode ID: e58c033abf34b20a0369d6302c3f186241a8faf940ce27c14a9b83951e8a766e
Instruction ID: e45e07e2fc979c99cdc0cc0b0d6e2121f98f0c75df60b524d8923bf4e1209cd2
Opcode Fuzzy Hash: e58c033abf34b20a0369d6302c3f186241a8faf940ce27c14a9b83951e8a766e
Instruction Fuzzy Hash: 1F3249B0D11669ABDB65CF9AD9883CDFBB5BB49304F9041EED20CB6211C7B01B988F45

Uniqueness

Uniqueness Score: -1.00%

Function 001F819F Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000000,00000000,00000000,?), ref: 001F81F5

Part of subcall function 00220141: OpenProcessToken.ADVAPI32(?,00000008,?,?,00000000,?,?,?,?,001F8201,00000000), ref: 0022015F
Part of subcall function 00220141: GetLastError.KERNEL32(?,?,?,?,001F8201,00000000), ref: 00220169
Part of subcall function 00220141: FindCloseChangeNotification.KERNEL32(?,?,?,?,?,001F8201,00000000), ref: 002201F3

GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 001F821B
GetLastError.KERNEL32 ref: 001F8225
GetTempPathW.KERNEL32(00000104,?,00000000), ref: 001F82A2
GetLastError.KERNEL32 ref: 001F82AC
UuidCreate.RPCRT4(?), ref: 001F82EB

Strings

Temp\, xrefs: 001F827A
Failed to ensure windows path for working folder ended in backslash., xrefs: 001F8270
Failed to create working folder guid., xrefs: 001F82F8
Failed to append bundle id on to temp path for working folder., xrefs: 001F8355
Failed to convert working folder guid into string., xrefs: 001F832B
Failed to get windows path for working folder., xrefs: 001F8253
Failed to concat Temp directory on windows path for working folder., xrefs: 001F8292
Failed to get temp path for working folder., xrefs: 001F82DA
%ls%ls\, xrefs: 001F833D
c:\agent\_work\66\s\src\burn\engine\cache.cpp, xrefs: 001F8249, 001F82D0, 001F8321
Failed to copy working folder path., xrefs: 001F8370

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: ErrorLast$Process$ChangeCloseCreateCurrentDirectoryFindNotificationOpenPathTempTokenUuidWindows
String ID: %ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$c:\agent\_work\66\s\src\burn\engine\cache.cpp
API String ID: 2898636500-2821718772
Opcode ID: cfaae645107570d7068b33e607373d7991a0d2472c4d7e9fac7165f853a9e47d
Instruction ID: 6ee87a68e082291e71960aa5cfea91b327e8d41866b4c5274368b1f930a63f55
Opcode Fuzzy Hash: cfaae645107570d7068b33e607373d7991a0d2472c4d7e9fac7165f853a9e47d
Instruction Fuzzy Hash: 3A41D576A54A39B7D720A6E49C0EFAF73ACAB01B11F114161BB05F7180EB74DD048AA1

Uniqueness

Uniqueness Score: -1.00%

Function 001E4326 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 157
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32 ref: 001E4352
InitializeCriticalSection.KERNEL32(?), ref: 001E435B
lstrlenW.KERNEL32(burn.filehandle.attached,?,?), ref: 001E43A1
lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000), ref: 001E43AB
CompareStringW.KERNEL32(0000007F,00000001,?,00000000), ref: 001E43BF
lstrlenW.KERNEL32(burn.filehandle.attached), ref: 001E43CF
lstrlenW.KERNEL32(burn.filehandle.self), ref: 001E441F
lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000), ref: 001E4429
CompareStringW.KERNEL32(0000007F,00000001,?,00000000), ref: 001E443D
lstrlenW.KERNEL32(burn.filehandle.self), ref: 001E444D

Strings

burn.filehandle.attached, xrefs: 001E439C, 001E43A4, 001E43A9, 001E43AA, 001E43CA, 001E44EC
Failed to parse file handle: '%ls', xrefs: 001E44CF
burn.filehandle.self, xrefs: 001E441A, 001E4422, 001E4427, 001E4428, 001E4448, 001E4518
Missing required parameter for switch: %ls, xrefs: 001E44F1
Failed to initialize engine section., xrefs: 001E44B6
c:\agent\_work\66\s\src\burn\engine\engine.cpp, xrefs: 001E44E2, 001E450E

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: lstrlen$CompareCriticalInitializeSectionString
String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$c:\agent\_work\66\s\src\burn\engine\engine.cpp
API String ID: 3039292287-2540856168
Opcode ID: 4350cd81fe09abe3d84176c2c482eff3c5530744dc8301d9da4e719337d28f82
Instruction ID: d828713180731d7853ce724297f29dadfad7d38e62fbcc8c409f2982d5bc9d80
Opcode Fuzzy Hash: 4350cd81fe09abe3d84176c2c482eff3c5530744dc8301d9da4e719337d28f82
Instruction Fuzzy Hash: 66514671B00665BFC7249FA9EC46F9E77A8FF11720F000115F619E7290DB74A960CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 001FE60C Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 134
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsSetValue.KERNEL32(?,?), ref: 001FE652
RegisterClassW.USER32(?), ref: 001FE67E
GetLastError.KERNEL32 ref: 001FE689
CreateWindowExW.USER32(00000080,002391B4,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 001FE6F0
GetLastError.KERNEL32 ref: 001FE6FA
UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 001FE798

Strings

WixBurnMessageWindow, xrefs: 001FE677, 001FE793
Failed to register window., xrefs: 001FE6B7
Unexpected return value from message pump., xrefs: 001FE783
c:\agent\_work\66\s\src\burn\engine\uithread.cpp, xrefs: 001FE6AD, 001FE71E
Failed to create window., xrefs: 001FE728

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$c:\agent\_work\66\s\src\burn\engine\uithread.cpp
API String ID: 213125376-1202977178
Opcode ID: 6dc038ad4f09adbcebc6844e1ef9735332116e34f83be4fb62f969371e5de53d
Instruction ID: d890be14531f5feae8fb2acc5985c48c73e58c0d48c370043b78093a736a881d
Opcode Fuzzy Hash: 6dc038ad4f09adbcebc6844e1ef9735332116e34f83be4fb62f969371e5de53d
Instruction Fuzzy Hash: 0141D376900229BBDB209FD4DC48AEEBFF8FF05760F104265FA05BA160D77499418BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00222368 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 78
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001E38D1: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 001E3910
Part of subcall function 001E38D1: GetLastError.KERNEL32 ref: 001E391A

Part of subcall function 00224289: GetLastError.KERNEL32(00000100,00000000,00000100,00000000,00000000,00000000,000000B8,00000100,00000000,000002C0,00000100,00000000), ref: 002242BA

GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 002223B2
GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 002223D2
GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 002223F2
GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 00222412
GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 00222432
GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 00222452
GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 00222472

Strings

MsiEnumProductsExW, xrefs: 002223E7
MsiSetExternalUIRecord, xrefs: 00222447
MsiDetermineApplicablePatchesW, xrefs: 002223C7
MsiGetPatchInfoExW, xrefs: 00222407
MsiGetProductInfoExW, xrefs: 00222427
Msi.dll, xrefs: 0022237A
MsiSourceListAddSourceExW, xrefs: 00222467
MsiDeterminePatchSequenceW, xrefs: 002223A7

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: AddressProc$ErrorLast$DirectorySystem
String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
API String ID: 2510051996-1735120554
Opcode ID: f952c36da70b9baa34c14a94ef10d0570541a0b75c056731d21ebbe22d073754
Instruction ID: 99def465aabee5d6fe8c0e764392119b905007f79bd9df199f308c5770dc6672
Opcode Fuzzy Hash: f952c36da70b9baa34c14a94ef10d0570541a0b75c056731d21ebbe22d073754
Instruction Fuzzy Hash: 8D3146B8921A65FBDB13AFA0FC0DB593BECE712708F12422AE50056571D7B28968CF44

Uniqueness

Uniqueness Score: -1.00%

Function 001EC252 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 131fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,?,001EC442,001E5442,?,?,001E5482), ref: 001EC299
GetLastError.KERNEL32(?,001EC442,001E5442,?,?,001E5482,?,00000000), ref: 001EC2AA
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,?,001EC442,001E5442,?,?,001E5482,?,00000000), ref: 001EC2F9
GetCurrentProcess.KERNEL32(000000FF,00000000,?,001EC442,001E5442,?,?,001E5482,?,00000000), ref: 001EC2FF
DuplicateHandle.KERNELBASE(00000000,?,001EC442,001E5442,?,?,001E5482,?,00000000), ref: 001EC302
GetLastError.KERNEL32(?,001EC442,001E5442,?,?,001E5482,?,00000000), ref: 001EC30C
SetFilePointerEx.KERNEL32(?,00000000,00000000,00000000,00000000,?,001EC442,001E5442,?,?,001E5482,?,00000000), ref: 001EC35E
GetLastError.KERNEL32(?,001EC442,001E5442,?,?,001E5482,?,00000000), ref: 001EC368

Strings

Failed to open container., xrefs: 001EC3B4
Failed to open file: %ls, xrefs: 001EC2DB
Failed to duplicate handle to container: %ls, xrefs: 001EC33D
Failed to move file pointer to container offset., xrefs: 001EC396
c:\agent\_work\66\s\src\burn\engine\container.cpp, xrefs: 001EC2CE, 001EC330, 001EC38C

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$c:\agent\_work\66\s\src\burn\engine\container.cpp
API String ID: 2619879409-3407532914
Opcode ID: fcca7fb7644602ec4024d79f48af728691b526b15af8449992cc943358278765
Instruction ID: e3dbf35a7cad018f692320756e39cda10591d96fdfb3cd767c7c2d8011581802
Opcode Fuzzy Hash: fcca7fb7644602ec4024d79f48af728691b526b15af8449992cc943358278765
Instruction Fuzzy Hash: 2A411A36140651BBDB208F56AC49E5F7BB6BBD5720F228015FD14EB241EB35C812DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0021F58A Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 76libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(SystemFunction040,AdvApi32.dll), ref: 0021F5B2
GetProcAddress.KERNEL32(SystemFunction041), ref: 0021F5C4
GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 0021F607
GetLastError.KERNEL32 ref: 0021F61B
GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 0021F653
GetLastError.KERNEL32 ref: 0021F667

Strings

CryptProtectMemory, xrefs: 0021F5FC
AdvApi32.dll, xrefs: 0021F591
Crypt32.dll, xrefs: 0021F5E8
CryptUnprotectMemory, xrefs: 0021F648
SystemFunction041, xrefs: 0021F5B4
SystemFunction040, xrefs: 0021F5A7
c:\agent\_work\66\s\src\libs\dutil\cryputil.cpp, xrefs: 0021F63C

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: AddressProc$ErrorLast
String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$c:\agent\_work\66\s\src\libs\dutil\cryputil.cpp
API String ID: 4214558900-686287438
Opcode ID: d8fc43d58bde61d043681e7df40eb4407d8fc286d46e762fdc832f452f34ff9a
Instruction ID: 9b2cbbbf262b7ade06ec7ee951150524f57734e4246b4c16e8aa31fb74d58608
Opcode Fuzzy Hash: d8fc43d58bde61d043681e7df40eb4407d8fc286d46e762fdc832f452f34ff9a
Instruction Fuzzy Hash: 7221D67A9616726BD3625F65BE0DB86B9D4A722750F820139EC31B6271E760CCA48F80

Uniqueness

Uniqueness Score: -1.00%

Function 002014E3 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 106COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,?,00000000,00000000,00000000,?,?,001EC3AE,?,00000000,?,001EC442), ref: 0020151A
GetLastError.KERNEL32(?,001EC3AE,?,00000000,?,001EC442,001E5442,?,?,001E5482,?,00000000), ref: 00201523

Strings

c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00201547, 0020158D, 002015D9
Failed to create begin operation event., xrefs: 00201551
Failed to wait for operation complete., xrefs: 002015F6
Failed to create operation complete event., xrefs: 00201597
Failed to create extraction thread., xrefs: 002015E3
Failed to copy file name., xrefs: 00201505

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: CreateErrorEventLast
String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 545576003-2015552351
Opcode ID: b2e9e29742f8d72548722056a2856353408580551dff6825a06d1da76e82844c
Instruction ID: 471991a9d3ec11bb052ea7ef5b5aa0d1a17de165f67ea0d4bdcdc2fccd7d1e76
Opcode Fuzzy Hash: b2e9e29742f8d72548722056a2856353408580551dff6825a06d1da76e82844c
Instruction Fuzzy Hash: 6221D6B397173B77E33116A59C4AE576D9CAF427A0F410211BD42BF6C2EA94DC3045E1

Uniqueness

Uniqueness Score: -1.00%

Function 00200671 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 105fileCOMMON

Download Yara Rule

APIs

CompareStringA.KERNEL32(00000000,00000000,<the>.cab,?,?), ref: 002006A1
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 002006B9
GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 002006BE
DuplicateHandle.KERNELBASE(00000000,?,?), ref: 002006C1
GetLastError.KERNEL32(?,?), ref: 002006CB
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 0020073A
GetLastError.KERNEL32(?,?), ref: 00200747

Strings

Failed to add virtual file pointer for cab container., xrefs: 00200720
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 002006EF, 0020076B
<the>.cab, xrefs: 0020069A
Failed to open cabinet file: %hs, xrefs: 00200778
Failed to duplicate handle to cab container., xrefs: 002006F9

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 3030546534-886985619
Opcode ID: 255711e73a5e59d6fb2803c73bd957253f22c724237c1af7bdaea423b764a984
Instruction ID: 0a57128afcf626b8fff7c1add3a2e1847a8fa2daf8ae884b74f80034bf4abc59
Opcode Fuzzy Hash: 255711e73a5e59d6fb2803c73bd957253f22c724237c1af7bdaea423b764a984
Instruction Fuzzy Hash: 61314376921236BBE7205B949C89F9FBE6CFF05760F010120FD04B7291DB69AD20CAE0

Uniqueness

Uniqueness Score: -1.00%

Function 00201286 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 87threadCOMMON

Download Yara Rule

APIs

WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,74DF2F60,?,?), ref: 002012AA
GetLastError.KERNEL32 ref: 002012BD
GetExitCodeThread.KERNEL32(?,00000000), ref: 002012FF
GetLastError.KERNEL32 ref: 0020130D
ResetEvent.KERNEL32(?), ref: 00201348
GetLastError.KERNEL32 ref: 00201352

Strings

Failed to reset operation complete event., xrefs: 00201383
c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 002012E4, 00201334, 00201379
Failed to wait for operation complete event., xrefs: 002012EE
Failed to get extraction thread exit code., xrefs: 0020133E

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2979751695-3513947302
Opcode ID: 67aa82ee38cf22b3765ceea38a5b320d78925223424bd5689cfaa15ebb551301
Instruction ID: fc499ace0dac756e89147bc60633d147eeb14298b70817dcef2ba7c0ab1262a4
Opcode Fuzzy Hash: 67aa82ee38cf22b3765ceea38a5b320d78925223424bd5689cfaa15ebb551301
Instruction Fuzzy Hash: 0231C370A20306FBE720DFA58D09BAE76E8BF01701F1041A9FD45EA5E1EB75DA609B11

Uniqueness

Uniqueness Score: -1.00%

Function 001ED679 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000008,00000000,?,001E4847,?,?,?,?,00000000,?), ref: 001ED68A
GetLastError.KERNEL32(?,001E4847,?,?,?,?,00000000,?), ref: 001ED697
GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 001ED6CF
GetLastError.KERNEL32(?,001E4847,?,?,?,?,00000000,?), ref: 001ED6DB

Strings

Failed to create UX., xrefs: 001ED71F
Failed to load UX DLL., xrefs: 001ED6C2
c:\agent\_work\66\s\src\burn\engine\userexperience.cpp, xrefs: 001ED6B8, 001ED6FC
Failed to get BootstrapperApplicationCreate entry-point, xrefs: 001ED706
BootstrapperApplicationCreate, xrefs: 001ED6C9

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$c:\agent\_work\66\s\src\burn\engine\userexperience.cpp
API String ID: 1866314245-3967977479
Opcode ID: 5658201368121a777db10ff924d36725efde76ab0b038bafb91b5531e2f6fa7c
Instruction ID: 095e3e3bd1009aa511303a086742aa47b08aab56dd3defbc48e120a5f39105a4
Opcode Fuzzy Hash: 5658201368121a777db10ff924d36725efde76ab0b038bafb91b5531e2f6fa7c
Instruction Fuzzy Hash: B311E237A90F72B7D7351A96BD09F5F3AA46B15B61F014135BE09FB280DB14DC104AD0

Uniqueness

Uniqueness Score: -1.00%

Function 001EF7B4 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 116registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 001EF8E4
RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 001EF8F1

Strings

Failed to format pending restart registry key to read., xrefs: 001EF7E8
%ls.RebootRequired, xrefs: 001EF7D1
Failed to open registration key., xrefs: 001EF84D
Resume, xrefs: 001EF858
Failed to read Resume value., xrefs: 001EF87A

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: Close
String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
API String ID: 3535843008-3890505273
Opcode ID: 5ae1193e9b1fafa8b83a28860d9ade3c5a1ba917ca52dfbc50d004be6cc1f388
Instruction ID: 3ebababe665592d7c2f70699e51ed28056a048be9fe24656c2388289fd40c091
Opcode Fuzzy Hash: 5ae1193e9b1fafa8b83a28860d9ade3c5a1ba917ca52dfbc50d004be6cc1f388
Instruction Fuzzy Hash: C0416D32D00999FFDB159F9AC981EADBBB4FF04310F11817AEC10AB251D3729E519B91

Uniqueness

Uniqueness Score: -1.00%

Function 00220141 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32(?,00000008,?,?,00000000,?,?,?,?,001F8201,00000000), ref: 0022015F
GetLastError.KERNEL32(?,?,?,?,001F8201,00000000), ref: 00220169
GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,001F8201,00000000), ref: 0022019B
GetLastError.KERNEL32(?,?,?,?,001F8201,00000000), ref: 002201B4
FindCloseChangeNotification.KERNEL32(?,?,?,?,?,001F8201,00000000), ref: 002201F3

Strings

c:\agent\_work\66\s\src\libs\dutil\procutil.cpp, xrefs: 002201E1

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: ErrorLastToken$ChangeCloseFindInformationNotificationOpenProcess
String ID: c:\agent\_work\66\s\src\libs\dutil\procutil.cpp
API String ID: 3650908616-2457365779
Opcode ID: e8b5088d55e13a4cda0706c22314d9f42f8583f342df10d3a42b26eebbe87287
Instruction ID: 004b24737db4a1d139a57951056970f3b320adc1e219c72efaa22b67e9d2c4df
Opcode Fuzzy Hash: e8b5088d55e13a4cda0706c22314d9f42f8583f342df10d3a42b26eebbe87287
Instruction Fuzzy Hash: F921D136D50236FBDB218FD5AC89B9EBAB8AF10710F014052ED09FB251D6B08F20DAD0

Uniqueness

Uniqueness Score: -1.00%

Function 00224289 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000100,00000000,00000100,00000000,00000000,00000000,000000B8,00000100,00000000,000002C0,00000100,00000000), ref: 002242BA
GlobalAlloc.KERNEL32(00000000,00000000,00000100,00000000,00000100,00000000,00000000,00000000,000000B8,00000100,00000000,000002C0,00000100,00000000), ref: 002242E7
GetLastError.KERNEL32(?,?,?,00000000), ref: 00224313
GetLastError.KERNEL32(00000000,0022A800,?,?,?,?,?,00000000), ref: 00224351
GlobalFree.KERNEL32(00000000), ref: 00224382

Strings

c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp, xrefs: 002242D5, 0022432E

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: ErrorLast$Global$AllocFree
String ID: c:\agent\_work\66\s\src\libs\dutil\fileutil.cpp
API String ID: 1145190524-1688708105
Opcode ID: 1fe0f02d31eff6f15c51662e3df5522eea56d70e774a2eed115daa3fda133e73
Instruction ID: 67aeffba6136f34026f3dace7f558bd71cf9fa75fa7635d5637aa41b67b1eddd
Opcode Fuzzy Hash: 1fe0f02d31eff6f15c51662e3df5522eea56d70e774a2eed115daa3fda133e73
Instruction Fuzzy Hash: 7C31E236D1023AFBD721EBD5AC05EAFBAA8AF44760F214251FC04EB240D670DD208AD0

Uniqueness

Uniqueness Score: -1.00%

Function 001E415F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,00000000,?,00000000,?,001E2FD9,?,00000000,?,?), ref: 001E416D
GetLastError.KERNEL32(?,001E2FD9,?,00000000,?,?), ref: 001E417B
CreateDirectoryW.KERNEL32(?,00000000,?,?,001E2FD9,?,00000000,?,?), ref: 001E41EB
GetLastError.KERNEL32(?,001E2FD9,?,00000000,?,?), ref: 001E41F5

Strings

c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp, xrefs: 001E4225

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID: c:\agent\_work\66\s\src\libs\dutil\dirutil.cpp
API String ID: 1375471231-2061300336
Opcode ID: dbdb9f3f74e60785720f6f76d0a0e3edd3c06c8d3e05c91e7867e738f5ff1f54
Instruction ID: 6c67770f3fb59e565ffe7952e24c53db5fb94e65e264e88407eb38b0dd8fc9e1
Opcode Fuzzy Hash: dbdb9f3f74e60785720f6f76d0a0e3edd3c06c8d3e05c91e7867e738f5ff1f54
Instruction Fuzzy Hash: 8D212636640AB3A7DB311FA37C04B3FB6A5EF66B60F124025FE44EB240D7249C4192D5

Uniqueness

Uniqueness Score: -1.00%

Function 00220708 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.KERNEL32(00000000,000000B8,000002C0,00000002,00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,?,00208B57,00000000,00000000), ref: 00220763
RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00208B57,00000000), ref: 00220781
RegEnumKeyExW.KERNEL32(00000000,000000B8,000002C0,00000002,00000000,00000000,00000000,00000000,?,?,00208B57,00000000,00000000,00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall), ref: 002207D7

Strings

c:\agent\_work\66\s\src\libs\dutil\regutil.cpp, xrefs: 002207A7

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: Enum$InfoQuery
String ID: c:\agent\_work\66\s\src\libs\dutil\regutil.cpp
API String ID: 73471667-3237223240
Opcode ID: 03e5173ede692bbaf2d74f8e25cd17d59a81d4dee39a7851a64d950283cafba9
Instruction ID: 2b857330514817f35371744219afa4367efd4bd463c88fb8684ac5f0810c4101
Opcode Fuzzy Hash: 03e5173ede692bbaf2d74f8e25cd17d59a81d4dee39a7851a64d950283cafba9
Instruction Fuzzy Hash: 2931807AD2113AFBEB218ED5DCC4EAFF66DEF04764F114065BD00AB111D7709E209AA0

Uniqueness

Uniqueness Score: -1.00%

Function 0022002E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62filestringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenA.KERNEL32(00201074,00000000,00000000,?,?,?,0021F8EB,00201074,00201074,?,00000000,0000FDE9,?,00201074,8007139F,Invalid operation for this state.), ref: 00220040
WriteFile.KERNEL32(000002E4,00000000,00000000,?,00000000,?,?,0021F8EB,00201074,00201074,?,00000000,0000FDE9,?,00201074,8007139F), ref: 0022007C
GetLastError.KERNEL32(?,?,0021F8EB,00201074,00201074,?,00000000,0000FDE9,?,00201074,8007139F,Invalid operation for this state.,c:\agent\_work\66\s\src\burn\engine\cabextract.cpp,000001C7,8007139F), ref: 00220086

Strings

c:\agent\_work\66\s\src\libs\dutil\logutil.cpp, xrefs: 002200B7

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: ErrorFileLastWritelstrlen
String ID: c:\agent\_work\66\s\src\libs\dutil\logutil.cpp
API String ID: 606256338-727082060
Opcode ID: ac5b537fc234ff7bd76a10d62ad20a78561e9ba76610b5025a7ba6d0a19e4abf
Instruction ID: 1fb89cdb58428dfd6c4507522a8ee300c6a658d524c5257c74ef06e2098fad91
Opcode Fuzzy Hash: ac5b537fc234ff7bd76a10d62ad20a78561e9ba76610b5025a7ba6d0a19e4abf
Instruction Fuzzy Hash: 8C11CA7691153577E3308EF5AC88FAFBA6CEB51760F010214FD01E7241D670DE5086E0

Uniqueness

Uniqueness Score: -1.00%

Function 0021F6FD Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59windowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00000900,?,?,00000000,?,00000000,20000064,?,?,?,0021FDC0,?,?,?,20000064,00000001), ref: 0021F71C
GetLastError.KERNEL32(?,?,?,0021FDC0,?,?,?,20000064,00000001,?,001E5651,?,?,00000000,?), ref: 0021F728
LocalFree.KERNEL32(00000000,?,?,?,00000002,?,?,?,0021FDC0,?,?,?,20000064,00000001,?,001E5651), ref: 0021F791

Strings

c:\agent\_work\66\s\src\libs\dutil\logutil.cpp, xrefs: 0021F747

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID: c:\agent\_work\66\s\src\libs\dutil\logutil.cpp
API String ID: 1365068426-727082060
Opcode ID: d2fa8e79f0da0d92898349ed0148a43ea39e8fa04cdd532c229df6ece123cdb5
Instruction ID: e5d9695bf44e5941922edfbf549f7332b96d8dd1d1de18f17f37c66fd6fc754b
Opcode Fuzzy Hash: d2fa8e79f0da0d92898349ed0148a43ea39e8fa04cdd532c229df6ece123cdb5
Instruction Fuzzy Hash: 6A11E732510126FBDF259F90DE09EEEBAA9EF64750F014025FD11A61A0D7308FA2D6A0

Uniqueness

Uniqueness Score: -1.00%

Function 002011B1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,?,?,00000000,00000000,?,?,?,00000000,?,002007C6,?,?,?), ref: 002011D9
GetLastError.KERNEL32(?,002007C6,?,?,?), ref: 002011E3

Strings

c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 00201207
Failed to move to virtual file pointer., xrefs: 00201211

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID: Failed to move to virtual file pointer.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 2976181284-1387633737
Opcode ID: 561f5e0503be370d71e6c95ea9bd8cb95c047de6c188e31acae111c08ae2a227
Instruction ID: dea68c3f35c586726ca5272b13013febc3b862c30a7216f41682276ea9809ce8
Opcode Fuzzy Hash: 561f5e0503be370d71e6c95ea9bd8cb95c047de6c188e31acae111c08ae2a227
Instruction Fuzzy Hash: B301F737920636BBC7251A96AC09D8BFF24FF01770B018125FD18A7541D725DC3086D0

Uniqueness

Uniqueness Score: -1.00%

Function 00200564 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000,?,002014B9,?,00000000,?,001EC24A,?,001E5442,?,001F7498,?,?,001E5442,?), ref: 0020056E
GetLastError.KERNEL32(?,002014B9,?,00000000,?,001EC24A,?,001E5442,?,001F7498,?,?,001E5442,?,001E5482,00000001), ref: 00200578

Strings

c:\agent\_work\66\s\src\burn\engine\cabextract.cpp, xrefs: 0020059C
Failed to set begin operation event., xrefs: 002005A6

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: ErrorEventLast
String ID: Failed to set begin operation event.$c:\agent\_work\66\s\src\burn\engine\cabextract.cpp
API String ID: 3848097054-3321223842
Opcode ID: bbe2c035f12194be3025c234c31df2b5f3897d46e067a5d3b5c0ab77acdd0941
Instruction ID: f613e91b1e587d57db3ec91067de5855c75ff78951c745c74f3315ca586c0977
Opcode Fuzzy Hash: bbe2c035f12194be3025c234c31df2b5f3897d46e067a5d3b5c0ab77acdd0941
Instruction Fuzzy Hash: B2F05C7393273127E32026956D0AB8B7AD8BF0AB60F010125FE00FB681FA549C604AE4

Uniqueness

Uniqueness Score: -1.00%

Function 001E5160 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(burn.clean.room), ref: 001E517F
CompareStringW.KERNEL32(0000007F,00000001,?,0000000F,burn.clean.room,0000000F), ref: 001E51AF

Strings

burn.clean.room, xrefs: 001E516C, 001E5179, 001E51A6

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: CompareStringlstrlen
String ID: burn.clean.room
API String ID: 1433953587-3055529264
Opcode ID: 157f2f40f3274bf2304dd20dd3d377d78808ee1cade9b0b4635dec00d9c57d37
Instruction ID: 011645de2d710e28e4065eb40bf9cc4a684f0ae60a8fa14863f2a11d6b00bcb5
Opcode Fuzzy Hash: 157f2f40f3274bf2304dd20dd3d377d78808ee1cade9b0b4635dec00d9c57d37
Instruction Fuzzy Hash: F401D676510E706B87284B8ABD88E7BBBBEEB1D7687200115F904C7610C3619C60C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 06DD0B38 Relevance: 3.9, Strings: 3, Instructions: 165COMMON

Download Yara Rule

Strings

PHdq, xrefs: 06DD0C6D
PHdq, xrefs: 06DD105D
`Qdq, xrefs: 06DD0EF0

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID: PHdq$PHdq$`Qdq
API String ID: 0-811037319
Opcode ID: 06f611ba831ef0b54ca23aff4e1a2ac116a62035b131ed9b2867b9ed2ab824a1
Instruction ID: ba9d0d089736403e26155415d7b36b351c982605811c5e5a717046ff988fef40
Opcode Fuzzy Hash: 06f611ba831ef0b54ca23aff4e1a2ac116a62035b131ed9b2867b9ed2ab824a1
Instruction Fuzzy Hash: 4C815770A0425DCFEB64EF64CC487A9BBB2FB88345F1041EAC64AA7690CB755E84CF41

Uniqueness

Uniqueness Score: -1.00%

Function 001EF6F9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 41registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00220823: RegOpenKeyExW.KERNEL32(00000100,000000B8,00000000,00000000,00000000,?,00000000,?,001EA2A1,?,00000000,?,000002C0,000002C0,?,00000000), ref: 00220837

RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,?,001F7C46,?,?,?), ref: 001EF75D

Part of subcall function 002208D7: RegQueryValueExW.ADVAPI32(00000004,?,00000000,00000000,?,?,?,00000000,?,?,?,00225034,00000000,?,?,?), ref: 002208FC

Strings

Installed, xrefs: 001EF725

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Installed
API String ID: 3677997916-3662710971
Opcode ID: c605e70566fc9b3fad1db7bde405847d208ad9ee71a36a9cfe5d4095438de043
Instruction ID: 566eeff8170fcd6cae4fab1de5397ed0a19f2c811d81905a6797bd56a0abdf69
Opcode Fuzzy Hash: c605e70566fc9b3fad1db7bde405847d208ad9ee71a36a9cfe5d4095438de043
Instruction Fuzzy Hash: 1B018B32D20128FFCB119B94D986BDEBAB8EF04725F1180A8E800AB150D3758E90DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 001E10DC Relevance: 3.0, APIs: 2, Instructions: 48fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000005,00000000), ref: 001E10F6

Part of subcall function 001E5160: lstrlenW.KERNEL32(burn.clean.room), ref: 001E517F
Part of subcall function 001E5160: CompareStringW.KERNEL32(0000007F,00000001,?,0000000F,burn.clean.room,0000000F), ref: 001E51AF

CloseHandle.KERNEL32(00000000), ref: 001E1131

Part of subcall function 001E11F8: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,001E110D), ref: 001E11FF

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: CloseCompareCreateFileHandleHeapInformationStringlstrlen
String ID:
API String ID: 4127744429-0
Opcode ID: de0e0381f9ddbaf29c5b0bc13b1ec9d31057064b4889ba2ae2fdd0c2fce6b7a2
Instruction ID: 9d516c804f506c0f1d6c5700d2e7c96d00e4504e0aa1bdff1f92b2a9d62aeeb6
Opcode Fuzzy Hash: de0e0381f9ddbaf29c5b0bc13b1ec9d31057064b4889ba2ae2fdd0c2fce6b7a2
Instruction Fuzzy Hash: E601F732A05AD87BCB11ABB59C09FDEBB75AF15710F144156FA12B20D2D7348C04D761

Uniqueness

Uniqueness Score: -1.00%

Function 0022506B Relevance: 1.6, APIs: 1, Instructions: 59registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(00000000,00000000,00000000,0024AA7C,00000000,00000000,00000000,?,001F89F4,WiX\Burn,PackageCache,00000000,0024AA7C,00000000,00000000,00000000), ref: 002250C5

Part of subcall function 0022095E: RegQueryValueExW.ADVAPI32(00000000,000000B8,00000000,00000000,00000088,000000B8,000000B8,BundleUpgradeCode,000002C0,00000088,000000B8,00000000), ref: 002209D4
Part of subcall function 0022095E: RegQueryValueExW.ADVAPI32(?,00000088,00000000,?,00000088,?), ref: 00220A0C

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: QueryValue$Close
String ID:
API String ID: 1979452859-0
Opcode ID: d976ed69b5e177933985712ea873370a72c73b181e9b24b480469b9d10f18963
Instruction ID: 1b60648ed8aabde76d1e91ef3cae8f923c247b217d9eb524dc7604cb0e43802f
Opcode Fuzzy Hash: d976ed69b5e177933985712ea873370a72c73b181e9b24b480469b9d10f18963
Instruction Fuzzy Hash: 88110236820A3BFBCB326ED4AD859AEB668EB08320B108039FD4123110DB314F70DAD1

Uniqueness

Uniqueness Score: -1.00%

Function 0021855E Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 002171F5: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,002159DE,00000001,00000364), ref: 00217236

_free.LIBCMT ref: 002185CA

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 0732909711a50b9945796346256193ab87f046156481c215ee8d356fc10d6c03
Instruction ID: 89ecda9c428dc31fc624f09a3841ab90d05a24e4bd4522438e858d7d9a108ad8
Opcode Fuzzy Hash: 0732909711a50b9945796346256193ab87f046156481c215ee8d356fc10d6c03
Instruction Fuzzy Hash: DC01D672610309ABE3218F69988199AFBEDFB99370F65052DE59493280EB30A9458B64

Uniqueness

Uniqueness Score: -1.00%

Function 002171F5 Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,002159DE,00000001,00000364), ref: 00217236

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 77c79821b0d454e7c673c684b53185c9dac9da89f3216185ce11af430802bd61
Instruction ID: 595652b9ded49f512c051e0a3dd2fe1c73415b8a22e13e32e64fd4c497571316
Opcode Fuzzy Hash: 77c79821b0d454e7c673c684b53185c9dac9da89f3216185ce11af430802bd61
Instruction Fuzzy Hash: 5AF0E93163C126779B216F62AC05BDA77E8AFF27B0B149121BC1996194CA30DCF346A0

Uniqueness

Uniqueness Score: -1.00%

Function 001E35A8 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 001E35C8

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: ef8f62c637b2b63fe356dbc946c403afd616085f76ea7a57d1ebe4b4f998461a
Instruction ID: 92453cff65dc83aadae14a76320ec88cc71ff44ad7a9948195212f47327e34b6
Opcode Fuzzy Hash: ef8f62c637b2b63fe356dbc946c403afd616085f76ea7a57d1ebe4b4f998461a
Instruction Fuzzy Hash: E1E01772341A647BAA016BA6AC09DFF7B9CEF297A1B004011FE40E7500DB72EA5157B1

Uniqueness

Uniqueness Score: -1.00%

Function 001E4238 Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(?,00000000,?,001E419C,?,00000000,?,001E2FD9,?,00000000,?,?), ref: 001E4241

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6ac50536580c1fc82a1fb1f9dbdffdf3301481cbff8a65f88701b0159f6d7382
Instruction ID: 71c157366f9ec86838b903a058b1fc9c1c33a6dc2dfc41b30f20fd06d14ce8fd
Opcode Fuzzy Hash: 6ac50536580c1fc82a1fb1f9dbdffdf3301481cbff8a65f88701b0159f6d7382
Instruction Fuzzy Hash: FFD02B312015245747284EFBB8085AE7B04DF417707404215FE3AC61D0D3304C1283C1

Uniqueness

Uniqueness Score: -1.00%

Function 001E14AC Relevance: 1.3, APIs: 1, Instructions: 52stringCOMMONLIBRARYCODE

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,?,00000000,?,?,001E22B1,?,00000000,?,00000000,?,001E39A5,?,?,00000104), ref: 001E14DC

Part of subcall function 001E3C5F: GetProcessHeap.KERNEL32(00000000,000001C7,?,001E22D5,000001C7,80004005,8007139F,?,?,0021FB39,8007139F,?,00000000,00000000,8007139F), ref: 001E3C67
Part of subcall function 001E3C5F: HeapSize.KERNEL32(00000000,?,001E22D5,000001C7,80004005,8007139F,?,?,0021FB39,8007139F,?,00000000,00000000,8007139F), ref: 001E3C6E

Memory Dump Source

Source File: 00000002.00000002.4128036134.00000000001E1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 001E0000, based on PE: true

Associated: 00000002.00000002.4127988440.00000000001E0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128117455.000000000022A000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128212966.000000000024A000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.000000000024D000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000257000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000002.00000002.4128279164.0000000000266000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_1e0000_setup.jbxd

Similarity

API ID: Heap$ProcessSizelstrlen
String ID:
API String ID: 3492610842-0
Opcode ID: 92eaf368a6dfcbf971c7e4fe4b4f5a9daa10a06299e914787f8b128ead01440c
Instruction ID: b8d02e64d0995209aa728262347e6aeafe2a7a83bf6bb92cf30e3982994e9570
Opcode Fuzzy Hash: 92eaf368a6dfcbf971c7e4fe4b4f5a9daa10a06299e914787f8b128ead01440c
Instruction Fuzzy Hash: 120128321009A4BBCF216E16DC85FDE7BAAAF81760F104111FE156B1D1C370EC0096A0

Uniqueness

Uniqueness Score: -1.00%

Function 06DD9F18 Relevance: 1.3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

Strings

4'dq, xrefs: 06DD9F1F

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID: 4'dq
API String ID: 0-1167855494
Opcode ID: bfe4b16c0f6b215dfe66cfa18ebfaf2f30028ee91be93584bf46ee9f488bd61f
Instruction ID: a28fecd533c44dc89db1c96b3ac79e75c83e559b9795543da979415c6df29a4c
Opcode Fuzzy Hash: bfe4b16c0f6b215dfe66cfa18ebfaf2f30028ee91be93584bf46ee9f488bd61f
Instruction Fuzzy Hash: F9E0C2312402245BC61DB3ADF8508AE379BDBC03603205A7DE20A87640EF607D4A87E6

Uniqueness

Uniqueness Score: -1.00%

Function 06B424C2 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4136555194.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b40000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10e2f186bb10d04d5ce44e40446e6acadc2f22f98d0c465c1aec03618aef26cc
Instruction ID: 71b7ddc46551343dec1ad18f234281e1eb8acf49a0dabbfb93f57a8957dadfd0
Opcode Fuzzy Hash: 10e2f186bb10d04d5ce44e40446e6acadc2f22f98d0c465c1aec03618aef26cc
Instruction Fuzzy Hash: ACF137B89016148FC7EDAF28D854BDABBA5AFC5300F460498D6EAAB351DA305942CF71

Uniqueness

Uniqueness Score: -1.00%

Function 06DDAE58 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbcdd4540439a39391f1913b49590773408e8f028e4f870d5c42df4cbb7c6bc0
Instruction ID: f1efe98598663d900ceca0b7c58ab7a427753ee516dd2107c40f6061834f80c2
Opcode Fuzzy Hash: fbcdd4540439a39391f1913b49590773408e8f028e4f870d5c42df4cbb7c6bc0
Instruction Fuzzy Hash: 2431AE31B402628BDBA53B3DD44823E77A7ABC4A51B1D8869E64BC7640DF34CC46C792

Uniqueness

Uniqueness Score: -1.00%

Function 02C0EBC0 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131159580.0000000002C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c0d000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7b91a85e2555e561c5bc920307486fa15b15114c2520b3c030d38873ace033f
Instruction ID: 98bdfe3cfc93ca01f69a1cfad0fdabf65078d747c5b36b12acdfa0f47e021bc7
Opcode Fuzzy Hash: f7b91a85e2555e561c5bc920307486fa15b15114c2520b3c030d38873ace033f
Instruction Fuzzy Hash: DC31F6B2144240EFDF069F54CAC0F26BF66FB88314F2489A9ED090A296C337D456DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02C0E0EC Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131159580.0000000002C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c0d000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8985be868b7a7f1483f6e3bd8957ef625c9e294004e9b3ef4c8aef85b8139bf5
Instruction ID: b2aaf282a911eea4f6069cbba69763664b8fce7f57754c349fff0bc2fe5b36fc
Opcode Fuzzy Hash: 8985be868b7a7f1483f6e3bd8957ef625c9e294004e9b3ef4c8aef85b8139bf5
Instruction Fuzzy Hash: 743181B2544200EFDF099F54CDC0F16BF66FB88314F248999EE094A2A7C336D866DB61

Uniqueness

Uniqueness Score: -1.00%

Function 02C0EAC4 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131159580.0000000002C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c0d000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24e233d05799659cf8caf26426fbfbc05d48cb19a889eb7a0fc84b16b230d9ef
Instruction ID: 22671e6b7198dcf15325ad68fb1fe6bf8af1bb732682d4c10ed52f231189e3ec
Opcode Fuzzy Hash: 24e233d05799659cf8caf26426fbfbc05d48cb19a889eb7a0fc84b16b230d9ef
Instruction Fuzzy Hash: 1B21F9B2544200EFDF158F54D9C0F26BFA5FBC8314F24CAA9ED0A0A296C336D556CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02C0D060 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131159580.0000000002C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c0d000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0eb249f10430848eaa4c83b2041115765d4a5b2698f30c8b0cbb28381b6ff51
Instruction ID: 8b8becb1e4fdcbd2e9c82b3aecee9b75fe65e29876730c8b16b4e0beacaa2e37
Opcode Fuzzy Hash: b0eb249f10430848eaa4c83b2041115765d4a5b2698f30c8b0cbb28381b6ff51
Instruction Fuzzy Hash: 4821F5B5604200DFDB14DF54D9C0F26BF65EB88328F24C56DD94E4B286C776D846CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 02C0EBBB Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131159580.0000000002C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c0d000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7657df9faad2a1c3128399312bb4ecf660e00c3273edb62281748034ace0bd71
Instruction ID: 02e9a31c4e0a653e8bb745b9cad2bac9200ed4ba0ea36ecfcd1d552fb15e6e45
Opcode Fuzzy Hash: 7657df9faad2a1c3128399312bb4ecf660e00c3273edb62281748034ace0bd71
Instruction Fuzzy Hash: 3521AF72500240DFCF068F50CAC4B55BF72FB88314F248699ED090A66AC336D466DB91

Uniqueness

Uniqueness Score: -1.00%

Function 02C0E0EB Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131159580.0000000002C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c0d000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e5ad61d3a39b0aefc303f846a25d65eda86fcd58b3696a385108ac9cf1203cd
Instruction ID: a04d507c62592897926ffabc94cac497a511fcdf552ea761d84037831dbd0e5a
Opcode Fuzzy Hash: 5e5ad61d3a39b0aefc303f846a25d65eda86fcd58b3696a385108ac9cf1203cd
Instruction Fuzzy Hash: BD216D76540240EFDF0ACF50CAC0B15BF72FB88314F248699ED094A26AC336D9A6DF51

Uniqueness

Uniqueness Score: -1.00%

Function 02C0EABF Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131159580.0000000002C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c0d000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d7905101472bf16835aa337e34210bc58ed858d4327beba5ebd4ead9b4f5638
Instruction ID: 281ad25ebcfa511e42dd40a4b47d22b5c104bb153230c62ec05eac8a7a40a26f
Opcode Fuzzy Hash: 5d7905101472bf16835aa337e34210bc58ed858d4327beba5ebd4ead9b4f5638
Instruction Fuzzy Hash: 5B21CF72400240DFCF12CF54DAC0B56BFB2FB88314F288699DD090A65AC336D566CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02C0D05B Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4131159580.0000000002C0D000.00000040.00000800.00020000.00000000.sdmp, Offset: 02C0D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2c0d000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed3658929396d5a992ef662d3847aad188a0dbe56eea84c5b65ec204ac4a7cbd
Instruction ID: 10c30d1d2cd3964ac6c735ac25f78e7599cd3720ff4828abdbdeb00e5e0c8fc0
Opcode Fuzzy Hash: ed3658929396d5a992ef662d3847aad188a0dbe56eea84c5b65ec204ac4a7cbd
Instruction Fuzzy Hash: D511D075504240DFDB11CF50D9C0B15BF71FB88328F24C6AAD84A4B696C33AD84ACF61

Uniqueness

Uniqueness Score: -1.00%

Function 06DDD178 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86dc2bd80c288956e4e7e20eb42f07ccb733e2920c22a516bcea1bde7a74d2a6
Instruction ID: 3b632ffe5e75235668f920619a7b307d0e2b5b11dc516f58f3088ad8eeabbfea
Opcode Fuzzy Hash: 86dc2bd80c288956e4e7e20eb42f07ccb733e2920c22a516bcea1bde7a74d2a6
Instruction Fuzzy Hash: B7F06D31A142248BEF24AFA6CC5459ABBBBAF44301F014879DD47A7384DB71EC068B81

Uniqueness

Uniqueness Score: -1.00%

Function 06B423FE Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4136555194.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b40000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3423b321fd8ac22366d83c96d7e1067c5242e41bb9500753e6cd22b3d4e82cac
Instruction ID: 979467a2d32510c9fb73010011c283ae0528763a66372d828b739f4e40d2bdd0
Opcode Fuzzy Hash: 3423b321fd8ac22366d83c96d7e1067c5242e41bb9500753e6cd22b3d4e82cac
Instruction Fuzzy Hash: 52010074A14214CFDB54DF64D85869DBBB6BF89310F1404EADA0AE7341DB359C41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06B41049 Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4136555194.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b40000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f75ffac03535c3bf118b672776c7c60f5863de88ce53a98fdee33662c5b48d5d
Instruction ID: 4d7a85c5761392ea31f03ee86d0efedd0d2c798d0cdddc079244a3cdf469f61f
Opcode Fuzzy Hash: f75ffac03535c3bf118b672776c7c60f5863de88ce53a98fdee33662c5b48d5d
Instruction Fuzzy Hash: 7F0197B4A01218CFD754CF68C984999BBF6BF88321F1595E5E809A7361C731ED40CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 06DDFCD0 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0316ee1cb13d146cf2c76e185ab3e6ad3956e9b108ca4cceb1d4b2f81e3dd777
Instruction ID: 21a849c9e43c9814951f708eafad30e6e3082e8339aebaad98315dfc45285fa4
Opcode Fuzzy Hash: 0316ee1cb13d146cf2c76e185ab3e6ad3956e9b108ca4cceb1d4b2f81e3dd777
Instruction Fuzzy Hash: 48E09A6170021827E70826BE1854B2BA98FEBC5760F24802EA20DCB3C0CCA2CC0103E0

Uniqueness

Uniqueness Score: -1.00%

Function 06DD20AC Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f522fe404ed84ed1788a211a4a18d35c5271446f764dc481af17fb1aa74946f6
Instruction ID: e7c65134db71b63b0b5bb494a28878b5f3fb48166bdccf4c0e5bb2aa58ff2f57
Opcode Fuzzy Hash: f522fe404ed84ed1788a211a4a18d35c5271446f764dc481af17fb1aa74946f6
Instruction Fuzzy Hash: 71F0C974B00208DFEB54AF35B45872D3AA3E789391F10946AE547E6680EE358C44AB11

Uniqueness

Uniqueness Score: -1.00%

Function 06DD5726 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 133e533d84042c1304862cc42ea8837a6b6d157133c5baa3e28be5582f9878f4
Instruction ID: 9c6802a7965c63f3273a416c4544ed557dad0f73d682241518b4c7e065f150b6
Opcode Fuzzy Hash: 133e533d84042c1304862cc42ea8837a6b6d157133c5baa3e28be5582f9878f4
Instruction Fuzzy Hash: 47F022305453045FE7009F64C9997EA3BB2FF89304F0040E5E9805E482CB799906DB41

Uniqueness

Uniqueness Score: -1.00%

Function 06DD0492 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ca44fedf0f6550d218308a8d357c1ac4494a4c40a836153b221fdfb3489f9e76
Instruction ID: 5d51947e2dd52957d5c4b7c7706027f3a9af4e90e2d965dedf6a982694b731ab
Opcode Fuzzy Hash: ca44fedf0f6550d218308a8d357c1ac4494a4c40a836153b221fdfb3489f9e76
Instruction Fuzzy Hash: 54F015B4A00218CFE790EF14E8656A877B2FB8D350F1040A4D64AE3740CB30AD848F50

Uniqueness

Uniqueness Score: -1.00%

Function 06DD4954 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eedf9ba40c25e9b53a082e4a7f5c77502c58d5da2593b973904b2fc6f19a6297
Instruction ID: 0a8842e2651864cd82276c4386bb0961e0c8a8910934b2512a3f7489d369dec4
Opcode Fuzzy Hash: eedf9ba40c25e9b53a082e4a7f5c77502c58d5da2593b973904b2fc6f19a6297
Instruction Fuzzy Hash: D0E0C270009181AFF7814F98C4097BB7FB0EF03398F5444CADC89A9083C2118212DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 06B4FA30 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4136555194.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b40000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98e2e870cb086bda8cd59840e1d11c94c7503a37ad69b6ebb59d5fc2b23fe46a
Instruction ID: bc9951938daf2a3125762960f538990de668c7871006aec7070ea3700a018d9e
Opcode Fuzzy Hash: 98e2e870cb086bda8cd59840e1d11c94c7503a37ad69b6ebb59d5fc2b23fe46a
Instruction Fuzzy Hash: 82D0A9B1C0120CABCB00FFF4880048EBFF8EB05200B0009EAE805EB200ED319A00B781

Uniqueness

Uniqueness Score: -1.00%

Function 06DD44BF Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92e061a0fbd7dea08e5185418210456a4b0aabd21c9a51bf13bb5294a0c220b7
Instruction ID: 6c5847b8825d1426bffd831be6c522461603917cc534d6734d44ab9a38ccb9e5
Opcode Fuzzy Hash: 92e061a0fbd7dea08e5185418210456a4b0aabd21c9a51bf13bb5294a0c220b7
Instruction Fuzzy Hash: 80D017349003698FEB56AF14C8967EA77B2EBC6220F4081A0804A66194DA744F86CF80

Uniqueness

Uniqueness Score: -1.00%

Function 06DD40BD Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59e4677b0b132b19459b78f96f84b646c99e1fe66b224ef5bb35c8af6d4a81e6
Instruction ID: f9cca0ce50b051a2d987a38164570eb1311fb3c19e2bd2428fdb9a64c9daf633
Opcode Fuzzy Hash: 59e4677b0b132b19459b78f96f84b646c99e1fe66b224ef5bb35c8af6d4a81e6
Instruction Fuzzy Hash: ADC022729402041FE3804B60C4092BA6FB1DB06231F1080179A06D3340DC3488811B61

Uniqueness

Uniqueness Score: -1.00%

Function 06DDF9C8 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bcaa562dafac37346c42d7c645c525802108420f1711c16604184842e2bf067
Instruction ID: 13e3b19e85e4ab64de2a33a7fa4fb7c2aa2b90875cb273882af4e6fc719d528c
Opcode Fuzzy Hash: 2bcaa562dafac37346c42d7c645c525802108420f1711c16604184842e2bf067
Instruction Fuzzy Hash: 35C02B3138403E03CA05368DB4042EF328FC7C4672F400066F30E83340CD544C0203EA

Uniqueness

Uniqueness Score: -1.00%

Function 06DD9CC0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49e5de4ff66c3ce87477a39d6f11c074227dfc6c052457fa69351bb018ec0dae
Instruction ID: 10354c0de3f62090f3e462dcebd7b3ee0d8dc5caec4c5f0b35ddd28b148045a2
Opcode Fuzzy Hash: 49e5de4ff66c3ce87477a39d6f11c074227dfc6c052457fa69351bb018ec0dae
Instruction Fuzzy Hash: C5C0123210022CBB8B025E84AC04CEA7B2AFB89660B048412FA184261086328921ABD0

Uniqueness

Uniqueness Score: -1.00%

Function 06DD03FF Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3350642cb2b0ff1f723320ab8a790cfcb948fe8c921f91e647fa0e547652d0fa
Instruction ID: b6f3c5db4f9d94f35feb4ade86b1b3da6979ed0d5d449496dfc9d0f3cac73e13
Opcode Fuzzy Hash: 3350642cb2b0ff1f723320ab8a790cfcb948fe8c921f91e647fa0e547652d0fa
Instruction Fuzzy Hash: CDD092B0744108DFE7446F21E46C72937B2EB89685F40502AEA86E6680DB348D45DA51

Uniqueness

Uniqueness Score: -1.00%

Function 06DD3815 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 478da99dd818a9a28c514a596fec4e1fcd853f5e91f3041aaa002b18bb94f6f5
Instruction ID: f8ee42d979b38735fb0c173c4382a1a681485a48d2379b918ea026ae3eefe17a
Opcode Fuzzy Hash: 478da99dd818a9a28c514a596fec4e1fcd853f5e91f3041aaa002b18bb94f6f5
Instruction Fuzzy Hash: DED0C974B04388DFEB911B78546D2AE3BF2EF4B240B5015A5D5C3EB790DA2485029741

Uniqueness

Uniqueness Score: -1.00%

Function 06DD12D8 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bd50d0c113a247e14cbf3286c3b29af3ce4f9e5f0aac30b5ee77043df64d35d
Instruction ID: f2b536357c4bd11015d44f737ce338f13bd3541015649f2cafad7cd87c182041
Opcode Fuzzy Hash: 5bd50d0c113a247e14cbf3286c3b29af3ce4f9e5f0aac30b5ee77043df64d35d
Instruction Fuzzy Hash: 9FD067B4E451188FDB94DF75D45869D76F3AB8C241F0090AAD54AE3740DA344D85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 06DDFFB0 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction ID: 89f7625bcd3042e5662e2b0f59687678129b36ffb3fe7dec0c562e4284fda470
Opcode Fuzzy Hash: 2f9c937b705b733c9644217cffe37b903ab6a11d94893328ab2d7921f8117b8c
Instruction Fuzzy Hash: 05C04C753042085F9344DA9DD851C26F7E9DBD8614714C06DA90DC7351EA72FD13C694

Uniqueness

Uniqueness Score: -1.00%

Function 06DD31C3 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 255bb32bc1f3478efc04422a68210253497f2801b40f5b760a02130395d72f14
Instruction ID: 34fbae22ed7c77b03376c73b3928d5b49fda5a6e56dd2055365c19ee8a11d4af
Opcode Fuzzy Hash: 255bb32bc1f3478efc04422a68210253497f2801b40f5b760a02130395d72f14
Instruction Fuzzy Hash: BED09E7494021D8BDB54DB15C8857E97273AFD4200F448695800A56164DE345A869F81

Uniqueness

Uniqueness Score: -1.00%

Function 06DD2F96 Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45c44b0466c72296c40d1fcc1f8a836c275f65ddf5f3a9a3376c35c989fa9aed
Instruction ID: 65ac1f47f1043b3a0b3812c814833d99f3b419e67cabe6af8e453aa580090e8c
Opcode Fuzzy Hash: 45c44b0466c72296c40d1fcc1f8a836c275f65ddf5f3a9a3376c35c989fa9aed
Instruction Fuzzy Hash: 0DD0C9745412C88FE7809F64E80C76D76B6EB4C351F109469A607E2690DF3849499B00

Uniqueness

Uniqueness Score: -1.00%

Function 06DD98A0 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc6833494455cd6d0746af0f38f35459bc9cf134319054845306dca7f866bf1
Instruction ID: a621fc3dd5b0b7ea48619aa0a9d80be83253342358ada43d99c1b0c1f024bf40
Opcode Fuzzy Hash: adc6833494455cd6d0746af0f38f35459bc9cf134319054845306dca7f866bf1
Instruction Fuzzy Hash: B5C08C604082EC4EF31113A0B00A3203FBA238360CF0C2880D7CD20E73C3AA204CF262

Uniqueness

Uniqueness Score: -1.00%

Function 06DD9750 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1594d93a6f0a8cdfa8fd9289cd544348cfe5f20df95678c334e2805c3ed5c716
Instruction ID: 6d9bc2b1490787b83bf9d7a9398c67dcaf0cc526b475210423a49d7bc3471a98
Opcode Fuzzy Hash: 1594d93a6f0a8cdfa8fd9289cd544348cfe5f20df95678c334e2805c3ed5c716
Instruction Fuzzy Hash: F4C04C36140108EFCB419F55E944C457F79FF197607118051F9484B231C732E924DB51

Uniqueness

Uniqueness Score: -1.00%

Function 06DD9C30 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df29431b0e75df59fb9d82fefd9855189ab42b2217a5557f6de6eb109a701f94
Instruction ID: acca5ed894aa250990723ee527a8bb1fd2382ad157b43449cccf6ee63172a9c1
Opcode Fuzzy Hash: df29431b0e75df59fb9d82fefd9855189ab42b2217a5557f6de6eb109a701f94
Instruction Fuzzy Hash: EDC04C39140108EFCB419F55D844C457FA9FF19760741C051F9494B631C732E960DB50

Uniqueness

Uniqueness Score: -1.00%

Function 06DD9E70 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaf3da1a1f7654bd0328a9ff792462c445d20ff7ec5ec8543e2db94934284fc0
Instruction ID: d7c0f644debebcec57557834b21b57ddcb3b4928483515accf08494e0856e31a
Opcode Fuzzy Hash: eaf3da1a1f7654bd0328a9ff792462c445d20ff7ec5ec8543e2db94934284fc0
Instruction Fuzzy Hash: 94B0923200030CBBCF027EA6D80085A7F2AAB11B60B50C026F908089218733D9A0EB90

Uniqueness

Uniqueness Score: -1.00%

Function 06DD29EF Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56475f14d0c4fb2d40203901bf430a57c5469e864dbc665300210fac2ba0c22a
Instruction ID: 5521f2b5b4acf9f3c0c72072552e4f96fb59d67df5da54325eafaab19728a46e
Opcode Fuzzy Hash: 56475f14d0c4fb2d40203901bf430a57c5469e864dbc665300210fac2ba0c22a
Instruction Fuzzy Hash: A8C08C74600108CFEB008F21C884B2CB7B3AF8C200F40C480A20A93600CA30CC489F00

Uniqueness

Uniqueness Score: -1.00%

Function 06DDBDE0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee846733e75b000ed788de50a25f9a9255276dd746525d5f7921d8811bc4c2c9
Instruction ID: fc1e053a3c38bde11aa49bf4aa07c811f852db17b056ad835b5e8b3be49e74e7
Opcode Fuzzy Hash: ee846733e75b000ed788de50a25f9a9255276dd746525d5f7921d8811bc4c2c9
Instruction Fuzzy Hash: BBB01230140208CFC300DF5CE549C513BECEF08A0430100D0F2088B332D722FC008A51

Uniqueness

Uniqueness Score: -1.00%

Function 06DD1492 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1ae13b6317161feabd1ca0867b8c20acecaa9612bd1eeb38883176fda9e552f1
Instruction ID: c081d7f344bd3e8b71242fd58f806af3002ac686bf90403e73f068c8d7ada7ca
Opcode Fuzzy Hash: 1ae13b6317161feabd1ca0867b8c20acecaa9612bd1eeb38883176fda9e552f1
Instruction Fuzzy Hash: 01C08CB0A000088FD740EF19C54075AB6F2ABC8300F10C0E8854C87380CE30CC458F40

Uniqueness

Uniqueness Score: -1.00%

Function 06DD9EA0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9daf118bfbcc3bf9e3a36b33321736fd5490af0d73cb682b29b312aa5d5cce5
Instruction ID: 0d3249c45e54e982a1c7318e279da309283474fafde044080f2c3a1230d30425
Opcode Fuzzy Hash: b9daf118bfbcc3bf9e3a36b33321736fd5490af0d73cb682b29b312aa5d5cce5
Instruction Fuzzy Hash: 42B092311402088F82009B58E548C0137A8AB08A143010090E1088B232C621FC008A51

Uniqueness

Uniqueness Score: -1.00%

Function 06DD9CA0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de847a0528bbc7a7393f5e98ae606a4b181b211cc876a90962d2b0a83971d2f4
Instruction ID: 03308a7015262dc60266e0276a8c8d94ddd012c5f0dd28833018c3f95f56e0d9
Opcode Fuzzy Hash: de847a0528bbc7a7393f5e98ae606a4b181b211cc876a90962d2b0a83971d2f4
Instruction Fuzzy Hash: 7EB092341602088F82009B59D448C0077ECAF08A0434140D0E1088B632C621F8008A40

Uniqueness

Uniqueness Score: -1.00%

Function 06DDA250 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d8aab7b27acfcf23e03a821c0a38eabfdf353c47741571ece64748c874a7303
Instruction ID: 6bcbee28325ccb1ada063393bef18b90e66bbfd3d4e1233165946919b4a6ffd0
Opcode Fuzzy Hash: 7d8aab7b27acfcf23e03a821c0a38eabfdf353c47741571ece64748c874a7303
Instruction Fuzzy Hash: 50B0923008020A8BC3203B68F80CA793B6AAA402167800060A30A811108A226E928A60

Uniqueness

Uniqueness Score: -1.00%

Function 06DD7A50 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c75d1f359baf881aebbd545750fb125bd9c5c0c39637b878c602c40b716e62d
Instruction ID: c33795987177c21f5cbdac8c9888cd4206e67c0f7a04de651ea4cb362d1e97b6
Opcode Fuzzy Hash: 7c75d1f359baf881aebbd545750fb125bd9c5c0c39637b878c602c40b716e62d
Instruction Fuzzy Hash: 29B092301502088FC200DA58D444C4077A8BB08A0430100D0E2088B232D622F8008A40

Uniqueness

Uniqueness Score: -1.00%

Function 06DD9B50 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0153114cbb90d83f7e9623173d4b3ce474c6f6f1c6f2bd9fa3e181210cc2973f
Instruction ID: e43fa2261f26c24e6e2085ab9b9681255d01cc6b605e4916266c3f49c9712a30
Opcode Fuzzy Hash: 0153114cbb90d83f7e9623173d4b3ce474c6f6f1c6f2bd9fa3e181210cc2973f
Instruction Fuzzy Hash: 52B0923200010CBB8B012EC1E8098897F3AFB14661B009021FA180482087329565AB90

Uniqueness

Uniqueness Score: -1.00%

Function 06DD7950 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1cdb4f687ab12025e8389c2fb21792c812de654467923881419b2744bb53e71
Instruction ID: 7de4840db72a739a7296ecabbd3d178890c8b70a70b6a7fce96b4b1d731f9c0f
Opcode Fuzzy Hash: d1cdb4f687ab12025e8389c2fb21792c812de654467923881419b2744bb53e71
Instruction Fuzzy Hash: 6AB092341502088F82409B59D449C00BBE8AF08A243454090E1088B632C621F8008A40

Uniqueness

Uniqueness Score: -1.00%

Function 06DDC978 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bbae12f460fd9d0cab7c3ea57492d191471a10b327c18cbb7c92820d1e6dde58
Instruction ID: 95010edd3c2b798f524490fbbc9dc5e21ffe36ea561cc49bed5e32369447a2e8
Opcode Fuzzy Hash: bbae12f460fd9d0cab7c3ea57492d191471a10b327c18cbb7c92820d1e6dde58
Instruction Fuzzy Hash: 4DB092B4040209CBC2803B64F90D4083B6AAA44202B880021A20A80298AF602800CA92

Uniqueness

Uniqueness Score: -1.00%

Function 06DD9C10 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c36d8595de6cee9400947c61ed06ad6347dacc94be26bd4bd7869ddcb9cc36e4
Instruction ID: 2449a3c453af86c3675e90617e92351427971b9e93ad94f3b19b4bb7ef2f13a2
Opcode Fuzzy Hash: c36d8595de6cee9400947c61ed06ad6347dacc94be26bd4bd7869ddcb9cc36e4
Instruction Fuzzy Hash: 0DB092311602088F82409B68E444C0073A8AB08A243114090E1088B232C621F8008A40

Uniqueness

Uniqueness Score: -1.00%

Function 06DD9E10 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1cdb4f687ab12025e8389c2fb21792c812de654467923881419b2744bb53e71
Instruction ID: 7de4840db72a739a7296ecabbd3d178890c8b70a70b6a7fce96b4b1d731f9c0f
Opcode Fuzzy Hash: d1cdb4f687ab12025e8389c2fb21792c812de654467923881419b2744bb53e71
Instruction Fuzzy Hash: 6AB092341502088F82409B59D449C00BBE8AF08A243454090E1088B632C621F8008A40

Uniqueness

Uniqueness Score: -1.00%

Function 06DDF628 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d47724affab394785ada6a760774b1d2db505f174f269bc8295796f33ad88df3
Instruction ID: b68d592eb8b030cafa6ddc251d5f6621ccbb416b6218736f77be6326988b4909
Opcode Fuzzy Hash: d47724affab394785ada6a760774b1d2db505f174f269bc8295796f33ad88df3
Instruction Fuzzy Hash: 49B0123004030D8BC500A7A4F849604371DE680604F801510F50C06605BE783C4857DA

Uniqueness

Uniqueness Score: -1.00%

Function 06B4F1B0 Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4136555194.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b40000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ab4bbdd17a120ddc1ef3c4cf224515beb75f8373d4b4482147fda78e6e90976
Instruction ID: 20159973dc6c4478fa717a34ac84a2881d4813b9dc5cbab7339b5de6a68ee492
Opcode Fuzzy Hash: 8ab4bbdd17a120ddc1ef3c4cf224515beb75f8373d4b4482147fda78e6e90976
Instruction Fuzzy Hash: 0DB01231250208CFC300DB6CE444C0033FCAF4DA1431000D0F10C8B331C721FC008A40

Uniqueness

Uniqueness Score: -1.00%

Function 06DD7A90 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1f29649c265192c2b9c934e33fdced41f4899560dc36286f45bc61b8afab50da
Instruction ID: bff747588276f33fe2ec51413123d05f45b630b57e9ee6c7ade1f2ec3f7847d3
Opcode Fuzzy Hash: 1f29649c265192c2b9c934e33fdced41f4899560dc36286f45bc61b8afab50da
Instruction Fuzzy Hash: 2FA0243300170CCFC34017707004150335CD5041173500074D30C11F114773D055C740

Uniqueness

Uniqueness Score: -1.00%

Function 06DD75B0 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68905e5b2d5c310604a9e9736a71a2ec52cdd851f2dccc48296f9b74a281f7d1
Instruction ID: b21ad1093e98837716449ac5ed752fbd90806b0e8d7da645c030640fb9e010aa
Opcode Fuzzy Hash: 68905e5b2d5c310604a9e9736a71a2ec52cdd851f2dccc48296f9b74a281f7d1
Instruction Fuzzy Hash: D6A02233082B0C82832032B82000020338C8C000083E008B88A0C8CA200C33E0A0A080

Uniqueness

Uniqueness Score: -1.00%

Function 06DD7910 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c18cbbc5a556b0b92aa56f6e972ee9bec68ba5574f2a456cf3f0133f2273fd4f
Instruction ID: 642e0c5bca831202f819283657721a8653254bd870d207848b1f15b66f49c23f
Opcode Fuzzy Hash: c18cbbc5a556b0b92aa56f6e972ee9bec68ba5574f2a456cf3f0133f2273fd4f
Instruction Fuzzy Hash: FEA02230002B0CCFCB002BB0F00802033AEFA0820A3C000B8F30C02E228BB3E020CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 06DD7B10 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 571bab7eff82534c6bcdc25d378c7116f1dbfae5b56c7dd1ed3c2c26f3930fa6
Instruction ID: a1bf353e851c32e68402f485791a365bb75bf596002233ec33a0557f8d36c0e0
Opcode Fuzzy Hash: 571bab7eff82534c6bcdc25d378c7116f1dbfae5b56c7dd1ed3c2c26f3930fa6
Instruction Fuzzy Hash: 1CB0123100020CAB86002A41E8058457F2DD7102617004021F6090041097325420A595

Uniqueness

Uniqueness Score: -1.00%

Function 06DD7930 Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8d9051730a5a0dbd7da55a9bfeb3b38ba5d543afc3c18ec1f0c2ba9368122a6
Instruction ID: 40d7d9df0e2ca707edcb1126e872d212208c433dfdbd1722b716e9e5dcc484f5
Opcode Fuzzy Hash: c8d9051730a5a0dbd7da55a9bfeb3b38ba5d543afc3c18ec1f0c2ba9368122a6
Instruction Fuzzy Hash: 74A0123001020C8F8100664CE405420B75D96485843008054910D83A034B62B8018780

Uniqueness

Uniqueness Score: -1.00%

Function 06DD74D0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ab882caf5cd05f3f427982c8cfa55fda5d24e697a308fc8ed296c8ab6c306a3
Instruction ID: 91882d54c71310b6645759f38edfa8abf82af67e57f2a5e78b9bda0a0c4af6db
Opcode Fuzzy Hash: 2ab882caf5cd05f3f427982c8cfa55fda5d24e697a308fc8ed296c8ab6c306a3
Instruction Fuzzy Hash: 6290023214464C9F45402795740E565B77DE544A557C05061A60D51D025A6564145595

Uniqueness

Uniqueness Score: -1.00%

Function 06DD97C0 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d631f2721d789898868a3f9779bb66660591155d7bdc8f293fac87777027826
Instruction ID: e232054ccaae7ba8e1e4e866aa6d6a121ff69ea5c0bcd1300bc511579d180857
Opcode Fuzzy Hash: 0d631f2721d789898868a3f9779bb66660591155d7bdc8f293fac87777027826
Instruction Fuzzy Hash: 9290023104560C8F45403795750E555777DA544D157801051E60D51D015A5568145996

Uniqueness

Uniqueness Score: -1.00%

Function 06DD7D70 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39f3c815155557b3acc2ed1d0ed9177950ab86d2bd8f26536bb77b351f01cfd2
Instruction ID: 77d54bb149ede2bd812a7d62f72db0e78b05af1d2baa6536997de13bc7233cd4
Opcode Fuzzy Hash: 39f3c815155557b3acc2ed1d0ed9177950ab86d2bd8f26536bb77b351f01cfd2
Instruction Fuzzy Hash: 6E90223000030C8F8E002380B00B000332CA000002BC00000B20E008000A0020008080

Uniqueness

Uniqueness Score: -1.00%

Function 06DD7E60 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18f28d537f67076b6e29a19d22a22e00bc75a5c160a8324d085e84d1ff82a077
Instruction ID: cd056789194a8534937f5f54758c9a768798cdf6862278ee4cfbb6ccb940cdf2
Opcode Fuzzy Hash: 18f28d537f67076b6e29a19d22a22e00bc75a5c160a8324d085e84d1ff82a077
Instruction Fuzzy Hash: 89902232000A0C8F000023A0380E000B33EA00CA003800000A20C00C020A2220000080

Uniqueness

Uniqueness Score: -1.00%

Function 06B4E280 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4136555194.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b40000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d9ff4d4d23755f5974800a338fd0f7b8bcc2c5144a8627195b92df0250d7551
Instruction ID: d95d6dddf4179f919cd0fbd37906579a101dc9a16beabdba30f25e85378c3317
Opcode Fuzzy Hash: 5d9ff4d4d23755f5974800a338fd0f7b8bcc2c5144a8627195b92df0250d7551
Instruction Fuzzy Hash: 4690023105560C8B4A4177A5760A695775D954C615FC40055A61D415425A5664104DE5

Uniqueness

Uniqueness Score: -1.00%

Function 06B4C590 Relevance: .0, Instructions: 5COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4136555194.0000000006B40000.00000040.00000800.00020000.00000000.sdmp, Offset: 06B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6b40000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edd65557266f9ef24770d448c1b61e3fe581ad0befe6659ee0d6ff2605ba5810
Instruction ID: 44966fa9e0aa8272ab6a4777b4fa15d06590485df5c46c1b412b9a106705a48c
Opcode Fuzzy Hash: edd65557266f9ef24770d448c1b61e3fe581ad0befe6659ee0d6ff2605ba5810
Instruction Fuzzy Hash: B890023105460CCB474167957409669779DA544619B880055E61D415415A5664208DE6

Uniqueness

Uniqueness Score: -1.00%

Function 06DD30A3 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58101eeff7fb6f30881efce3d741468665e5975f52cc97584d830113afb2c03c
Instruction ID: 47aa494eb62a12a3dbb11605b92092b371d335609bcd4e641094c5d65cf6609d
Opcode Fuzzy Hash: 58101eeff7fb6f30881efce3d741468665e5975f52cc97584d830113afb2c03c
Instruction Fuzzy Hash: 35B0127010000C8FD3506E00C45C36C3332A748340F4040549502526408D384C889A50

Uniqueness

Uniqueness Score: -1.00%

Function 06DD1846 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a0fb05114bd5eaa12418533ae509e0de777c93aeca48c391619d113b57a68d3a
Instruction ID: 22f99a76e986126f0c2d416b80a94b19b82291c9ab8c205c86f77de79407e929
Opcode Fuzzy Hash: a0fb05114bd5eaa12418533ae509e0de777c93aeca48c391619d113b57a68d3a
Instruction Fuzzy Hash: 3DB01234145108CFD3406E00CC0476872329749342F0040919443D11408A384C408A01

Uniqueness

Uniqueness Score: -1.00%

Function 06DD1B6D Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.4137316412.0000000006DD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 06DD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_6dd0000_setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13af257a958ed1a2881b6bc792663225b023ef7d6a9075251bcf85b69cf29ab9
Instruction ID: eaf5870642c83a927d92f0878cc28d4831a13c7a8e0ed02e392ee2c96ed8853a
Opcode Fuzzy Hash: 13af257a958ed1a2881b6bc792663225b023ef7d6a9075251bcf85b69cf29ab9
Instruction Fuzzy Hash: 44900234244049AFE3405D55A00A66A65369355341F40A013B9C29564096A494545651

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report TsU2RShnl7.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\installer[1].exe

C:\Users\user\AppData\Local\Temp\AdGuardVPN_20240312102059.log

C:\Users\user\AppData\Local\Temp\adguard\setup.exe

C:\Windows\Temp\{7D533DA3-7EED-49D4-8961-01FA959AC4E2}\.cr\setup.exe

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1028\mbapreq.wxl

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1029\mbapreq.wxl

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1030\mbapreq.wxl

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1031\mbapreq.wxl

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1032\mbapreq.wxl

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1035\mbapreq.wxl

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1036\mbapreq.wxl

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1038\mbapreq.wxl

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1040\mbapreq.wxl

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1041\mbapreq.wxl

C:\Windows\Temp\{DEAE4E28-3932-441D-9739-2BDC0FD8B648}\.ba\1042\mbapreq.wxl

Windows Analysis Report
TsU2RShnl7.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre